,,ii  #aad? ,,congress  #a/ ,session    
,s4 #ifa  ,,9 ,,! ,,s5ate ,,( ,,!       
,,unit$ ,,/ates  ,april #ae1 #bjae,mr4  
,c>p] 7= himself & ,mr4 ,blunt7         
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,comm]ce1 ,sci5ce1 & ,transportation  ,a
 ,,bill  ,to protect in=mation relat+ to
 consum]s1 to require notice ( security 
brea*es1 & = o!r purposes4  #a4 ,%ort   
title ,?is ,act may be cit$ z ! ,data   
,security ,act ( #bjae4  #b4 ,purposes  
,! purposes ( ?is ,act are-- 7#a7 to    
e/abli% /rong & uni=m national data     
security & brea* notification /&>ds =   
electronic data2 &  7#b7 to expressly   
preempt any relat$ ,/ate laws 9 ord] to 
provide ! ,f$]al ,trade ,commission )   
au?ority to en=ce su* /&>ds = entities  
cov]$ "u ?is ,act4  #c4 ,def9itions ,=  
purposes ( ?is ,act1 ! foll[+ def9itions
 %all apply3  7#a7 ,affiliate ,! t]m    
affiliate means any company t controls1 
is controll$ by1 or is "u common control
 ) ano!r company4  7#b7 ,ag5cy ,! t]m   

ag5cy has ! same mean+ z 9 section      
#eea7a7 ( title #e1 ,unit$ ,/ates ,code4
  7#c7 ,brea* ( data security  7,a7 ,9  
g5]al ,! t]m brea* ( data security means
 ! unau?oriz$ acquisition ( s5sitive    
acc\nt in=mation or s5sitive p]sonal    
in=mation4  7,b7 ,exception = data t is 
n 9 usable =m ,! t]m brea* ( data       
security does n include ! unau?oriz$    
acquisition ( s5sitive acc\nt in=mation 
or s5sitive p]sonal in=mation t is      
encrypt$1 r$act$1 or o!rwise protect$ by
 ano!r me?od t r5d]s ! in=mation        
unreadable & unusable if ! encryption1  
r$action1 or protection process or key  
is n also acquir$ )\t au?orization4     
7#d7 ,c>ri] ,! t]m c>ri] means any      
entity t-- 7,a7 provides electronic data
 transmission1 r\t+1 int]m$iate1 &      
transi5t /orage1 or connections to its  
sy/em or network2  7,b7 does n select or
 modify ! cont5t ( ! electronic data2   
7,c7 is n ! s5d] or ! int5d$ recipi5t ( 
! data2 &  7,d7 does n diff]5tiate      
s5sitive acc\nt in=mation or s5sitive   

p]sonal in=mation f o!r in=mation t !   
entity transmits1 r\tes1 /ores 9        
int]m$iate or transi5t /orage1 or = :i* 
su* entity provides connections4  7#e7  
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#f7        
,consum] ,! t]m consum] means an        
individual4  7#g7 ,consum] report+ ag5cy
 t compiles & ma9ta9s files on consum]s 
on a nationwide basis ,! t]m consum]    
report+ ag5cy t compiles & ma9ta9s files
 on consum]s on a nationwide basis has !
 same mean+ z 9 section #fjc7p7 ( !     
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afha;a7p774  7#h7 ,cov]$     
entity  7,a7 ,9 g5]al ,! t]m cov]$      
entity means any individual1 p>tn]%ip1  
corporation1 tru/1 e/ate1 coop]ative1   
association or entity t accesses1       
ma9ta9s1 communicates1 or h&les s5sitive
 acc\nt in=mation or s5sitive p]sonal   
in=mation4  7,b7 ,exception ,! t]m cov]$
 entity does n include any ag5cy or any 
o!r unit ( ,f$]al1 ,/ate1 or local      
gov]nm5t or any subdivision ( ! unit4   

7#i7 ,f9ancial in/itution ,! t]m        
f9ancial in/itution has ! same mean+ z 9
 section #eji7c7 ( !                    
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhji7c774  7#aj7 ,in=mation security  
program ,! t]m in=mation security       
program means ! adm9i/rative1 te*nical1 
or physical safegu>ds t a cov]$ entity  
uses to access1 collect1 di/ribute1     
process1 protect1 /ore1 use1 transmit1  
dispose (1 or o!rwise h&le s5sitive     
acc\nt in=mation & s5sitive p]sonal     
in=mation4  7#aa7 ,s5sitive acc\nt      
in=mation ,! t]m s5sitive acc\nt        
in=mation means a f9ancial acc\nt numb] 
relat+ to a consum]1 includ+ a cr$it c>d
 numb] or debit c>d numb]1 9 comb9ation 
) any security code1 access code1       
password1 or o!r p]sonal id5tification  
in=mation requir$ to access ! f9ancial  
acc\nt4  7#ab7 ,s5sitive p]sonal        
in=mation  7,a7 ,9 g5]al ,! t]m s5sitive
 p]sonal in=mation means-- 7i7 a ,social
 ,security numb]2 or  7ii7 ! fir/ & la/ 
"n ( a consum] 9 comb9ation )-- 7,i7 !  

consum]'s driv]'s lic5se numb]1 passport
 numb]1 milit>y id5tification numb]1 or 
o!r simil> numb] issu$ on a gov]nm5t    
docum5t us$ to v]ify id5tity2  7,,ii7   
in=mation t c\ld be us$ to access a     
consum]'s acc\nt1 su* z a us] "n &      
password or e-mail & password2 or       
7,,iii7 biometric data ( ! consum] us$  
to ga9 access to f9ancial acc\nts ( !   
consum]4  7,b7 ,exception ,! t]m        
s5sitive p]sonal in=mation does n       
include publicly available in=mation t  
is lawfully made available to ! g5]al   
public & obta9$ f--  7i7 ,f$]al1 ,/ate1 
or local gov]nm5t records2 or  7ii7     
widely di/ribut$ m$ia4  7#ac7           
,sub/antial h>m or inconv5i5ce ,! t]m   
sub/antial h>m or inconv5i5ce means--   
7,a7 id5tity !ft2 or  7,b7 fraudul5t    
transactions on f9ancial acc\nts4  7#ad7
 ,?ird-p>ty s]vice provid] ,! t]m       
?ird-p>ty s]vice provid] means any p]son
 t ma9ta9s1 processes1 or o!rwise is    
p]mitt$ access to s5sitive acc\nt       
in=mation or s5sitive p]sonal in=mation 

9 connection ) provid+ s]vices to a     
cov]$ entity4  #d4 ,protection (        
in=mation & security brea* notification 
7a7 ,security proc$ures requir$  7#a7 ,9
 g5]al ,ea* cov]$ entity %all develop1  
implem5t1 & ma9ta9 a compreh5sive       
in=mation security program t conta9s    
adm9i/rative1 te*nical1 & physical      
safegu>ds t are reasonably design$ to   
a*ieve ! objectives 9 p>agraph 7#b74    
7#b7 ,objectives ,! objectives ( ?is    
subsection are to-- 7,a7 ensure !       
security & confid5tiality ( s5sitive    
acc\nt in=mation & s5sitive p]sonal     
in=mation2  7,b7 protect aga9/ any      
anticipat$ ?reats or haz>ds to !        
security or integrity ( su* in=mation2 &
  7,c7 protect aga9/ unau?oriz$         
acquisition ( su* in=mation t c\ld      
result 9 sub/antial h>m to ! individuals
 to :om su* in=mation relates4  7#c7    
,limitation ,a cov]$ entity's in=mation 
security program "u p>agraph 7#a7 %all  
be appropriate to-- 7,a7 ! size &       
complexity ( ! cov]$ entity2  7,b7 !    

nature & scope ( ! activities ( ! cov]$ 
entity2 &  7,c7 ! s5sitivity ( ! consum]
 in=mation to be protect$4  7#d7        
,elem5ts ,9 ord] to develop1 implem5t1 &
 ma9ta9 its in=mation security program1 
a cov]$ entity %all--  7,a7 designate an
 employee or employees to coord9ate !   
in=mation security program2  7,b7       
id5tify reasonably =eseeable int]nal &  
ext]nal risks to ! security1            
confid5tiality1 & integrity ( s5sitive  
acc\nt in=mation & s5sitive p]sonal     
in=mation & assess ! suffici5cy ( any   
safegu>ds 9 place to control ^! risks1  
includ+ consid]ation ( risks 9 ea*      
relevant area ( ! cov]$ entity's        
op]ations1 includ+--  7i7 employee tra9+
 & managem5t2  7ii7 in=mation sy/ems1   
includ+ network & s(tw>e design1 z well 
z in=mation process+1 /orage1           
transmission1 & disposal2 &  7iii7      
detect+1 prev5t+ & respond+ to attacks1 
intrusions1 or o!r sy/ems failures2     
7,c7 design & implem5t in=mation        
safegu>ds to control ! risks id5tifi$ 9 

its risk assessm5t1 & regul>ly assess ! 
effectiv5ess ( ! safegu>ds' key         
controls1 sy/ems1 & proc$ures2  7,d7    
ov]see s]vice provid]s by-- 7i7 tak+    
reasonable /eps to select & reta9 s]vice
 provid]s t are capable ( ma9ta9+       
appropriate safegu>ds = ! s5sitive      
acc\nt in=mation or s5sitive p]sonal    
in=mation at issue2  7ii7 requir+ s]vice
 provid]s by contract to implem5t &     
ma9ta9 su* safegu>ds2 &  7iii7          
reasonably ov]see or obta9 an assessm5t 
( ! s]vice provid]'s compliance )       
contractual obligations1 :]e appropriate
 9 light ( ! cov]$ entity's risk        
assessm5t2 &  7,e7 evaluate & adju/ !   
in=mation security program 9 light ( !  
results ( ! risk assessm5ts & te/+ &    
monitor+ requir$ by subp>agraphs 7,c7 & 
7,d7 & any mat]ial *anges to ! cov]$    
entity's op]ations or bus9ess           
arrangem5ts1 or any o!r circum/ances t !
 cov]$ entity kn[s or has reason to "k  
may h a mat]ial impact on its in=mation 
security program4  7#e7 ,security       

controls ,ea* cov]$ entity %all-- 7,a7  
consid] :e!r ! foll[+ security measures 
are appropriate = ! cov]$ entity &1 if  
s1 adopt ^? measures t ! cov]$ entity   
concludes are appropriate--  7i7 access 
controls on in=mation sy/ems1 includ+   
controls to au!nticate & p]mit access   
only to au?oriz$ individuals & controls 
to prev5t employees f provid+ s5sitive  
acc\nt in=mation or s5sitive p]sonal    
in=mation to unau?oriz$ individuals :o  
may seek to obta9 ?is in=mation ?r\gh   
fraudul5t means2  7ii7 access           
re/rictions at physical locations       
conta9+ s5sitive acc\nt in=mation or    
s5sitive p]sonal in=mation1 su* z       
build+s1 comput] facilities1 & records  
/orage facilities1 to p]mit access only 
to au?oriz$ individuals2  7iii7         
encryption ( electronic s5sitive acc\nt 
in=mation or s5sitive p]sonal in=mation1
 includ+ :ile 9 transit or 9 /orage on  
networks or sy/ems to :i* unau?oriz$    
individuals may h access2  7iv7         
proc$ures design$ to ensure t in=mation 

sy/em modifications are consi/5t ) !    
cov]$ entity's in=mation security       
program2  7v7 dual control proc$ures1   
segregation ( duties1 & employee        
backgr\nd *ecks = employees )           
responsibilities =1 or access to1       
s5sitive acc\nt in=mation or s5sitive   
p]sonal in=mation2  7vi7 monitor+ sy/ems
 & proc$ures to detect actual & attempt$
 attacks on1 or intrusions into1        
in=mation sy/ems2  7vii7 response       
programs t specify actions to be tak5 :5
 ! cov]$ entity suspects or detects t   
unau?oriz$ individuals h ga9$ access to 
in=mation sy/ems2 &  7viii7 measures to 
protect aga9/ de/ruction1 loss1 or      
damage ( s5sitive acc\nt in=mation or   
s5sitive p]sonal in=mation due to       
pot5tial environm5tal haz>ds1 su* z fire
 & wat] damage or te*nological failures2
  7,b7 develop1 implem5t1 & ma9ta9      
appropriate measures to prop]ly dispose 
( s5sitive acc\nt in=mation & s5sitive  
p]sonal in=mation2 &  7,c7 tra9 /aff to 
implem5t ! cov]$ entity's in=mation     

security program4  7#f7 ,adm9i/rative   
requirem5ts  7,a7 ,bo>d ov]sight ,if a  
cov]$ entity has a bo>d ( directors1 !  
cov]$ entity's bo>d ( directors or an   
appropriate committee ( ! bo>d %all--   
7i7 approve ! cov]$ entity's writt5     
in=mation security program2 &  7ii7     
ov]see ! developm5t1 implem5tation1 &   
ma9t5ance ( ! cov]$ entity's in=mation  
security program1 includ+ assign+       
specific responsibility = its           
implem5tation & review+ reports f       
managem5t4  7,b7 ,report to ! bo>d ,if a
 cov]$ entity has a bo>d ( directors1 ! 
cov]$ entity %all report to its bo>d or 
an appropriate committee ( ! bo>d at    
lea/ annually1 includ+ describ+--  7i7 !
 ov]all /atus ( ! in=mation security    
program & ! cov]$ entity's compliance ) 
?is ,act2 &  7ii7 mat]ial matt]s relat$ 
to its program1 address+ issues su* z   
risk assessm5t1 risk managem5t & control
 decisions1 s]vice provid] arrangem5ts1 
results ( te/+1 security brea*es or     
violations & managem5t's responses1 &   

recomm5dations = *anges 9 ! in=mation   
security program4  7b7 ,inve/igation    
requir$  7#a7 ,9 g5]al ,if a cov]$      
entity believes t a brea* ( data        
security has or may h occurr$ 9 relation
 to s5sitive acc\nt in=mation or        
s5sitive p]sonal in=mation t is ma9ta9$1
 communicat$1 or o!rwise h&l$ by1 or on 
behalf (1 ! cov]$ entity1 ! cov]$ entity
 %all conduct an inve/igation to--  7,a7
 assess ! nature & scope ( ! incid5t2   
7,b7 id5tify any s5sitive acc\nt        
in=mation or s5sitive p]sonal in=mation 
t may h be5 involv$ 9 ! incid5t2  7,c7  
det]m9e if ! s5sitive acc\nt in=mation  
or s5sitive p]sonal in=mation has be5   
acquir$ )\t au?orization2 &  7,d7 take  
reasonable measures to re/ore ! security
 & confid5tiality ( ! sy/ems compromis$ 
9 ! brea*4  7c7 ,notice requir$ ,if a   
cov]$ entity det]m9es "u subsection     
7b77#a77;,c7 t ! unau?oriz$ acquisition 
( s5sitive acc\nt in=mation or s5sitive 
p]sonal in=mation involv$ 9 a brea* (   
data security is reasonably likely to   

cause sub/antial h>m to ! consum]s to   
:om ! in=mation relates1 ! cov]$ entity1
 or a ?ird p>ty act+ on behalf ( ! cov]$
 entity1 %all--  7#a7 notify1 )\t       
unreasonable delay-- 7,a7 an appropriate
 ,f$]al law en=cem5t ag5cy2  7,b7 !     
appropriate ag5cy or au?ority id5tifi$ 9
 section #e2  7,c7 any relevant paym5t  
c>d network1 if ! brea* involves a brea*
 ( paym5t c>d numb]s2  7,d7 ea* consum] 
report+ ag5cy t compiles & ma9ta9s files
 on consum]s on a nationwide basis1 if !
 brea* involves s5sitive p]sonal        
in=mation or s5sitive acc\nt in=mation  
relat+ to #e1jjj or m consum]s2 &  7,e7 
all consum]s to :om ! s5sitive acc\nt   
in=mation or s5sitive p]sonal in=mation 
relates2  7#b7 provide notice to        
consum]s by--  7,a7 writt5 notification 
s5t to ! po/al address ( ! consum] 9 !  
records ( ! cov]$ entity2  7,b7         
telephonic notification to ! numb] ( !  
consum] 9 ! records ( ! cov]$ entity2   
7,c7 e-mail ( ! consum] or o!r          
electronic means 9 ! records ( ! cov]$  

entity2 or  7,d7 sub/itute notification 
9 pr9t & to broadca/ m$ia :]e !         
individual ^: p]sonal in=mation 0       
acquir$ resides1 if provid+ writt5 or   
e-mail notification is n feasible due   
to--  7i7 lack ( suffici5t contact      
in=mation = ! consum]s t mu/ be notifi$2
  7ii7 excessive co/ to ! cov]$ entity2 
or  7iii7 exig5t circum/ances2 &  7#c7  
provide notice t includes--  7,a7 a     
description ( ! type ( s5sitive acc\nt  
in=mation or s5sitive p]sonal in=mation 
involv$ 9 ! brea* ( data security2  7,b7
 a g5]al description ( ! actions tak5 by
 ! cov]$ entity to re/ore ! security &  
confid5tiality ( ! s5sitive acc\nt      
in=mation or s5sitive p]sonal in=mation 
involv$ 9 ! brea* ( data security2 &    
7,c7 a summ>y ( rights ( victims (      
id5tity !ft prep>$ by ! ,commission "u  
section #fji7;d7 ( ! ,fair ,cr$it       
,report+ ,act 7#ae ,u4,s4,c4            
#afha;g7d771 if ! brea* ( data security 
involves s5sitive p]sonal in=mation4    
7d7 ,cl>ification ,a f9ancial in/itution

 %all h no obligation "u ?is ,act = a   
brea* ( security at ano!r cov]$ entity  
involv+ s5sitive acc\nt in=mation relat+
 to an acc\nt own$ by ! f9ancial        
in/itution4  7e7 ,special notification  
requirem5ts  7#a7 ,?ird-p>ty s]vice     
provid]s ,9 ! ev5t ( a brea* ( data     
security ( a sy/em ma9ta9$ by a         
?ird-p>ty entity t has be5 contract$ to 
ma9ta91 /ore1 or process data 9         
electronic =m conta9+ s5sitive acc\nt   
in=mation or s5sitive p]sonal in=mation 
on behalf ( a cov]$ entity :o owns or   
possesses su* data1 su* ?ird-p>ty %all--
  7,a7 notify ! cov]$ entity2 &  7,b7   
notify consum]s if x is agre$ 9 writ+ t 
! ?ird-p>ty s]vice provid] w provide su*
 notification on behalf ( ! cov]$       
entity4  7#b7 ,c>ri] obligations  7,a7  
,9 g5]al ,if a c>ri] becomes aw>e ( a   
brea* ( data security involv+ data 9    
electronic =m conta9+ s5sitive acc\nt   
in=mation or s5sitive p]sonal in=mation 
t is own$ or lic5s$ by a cov]$ entity t 
connects to or uses a sy/em or network  

provid$ by ! c>ri] = ! purpose (        
transmitt+1 r\t+1 or provid+ int]m$iate 
or transi5t /orage ( su* data1 su* c>ri]
 %all notify ! cov]$ entity :o initiat$ 
su* connection1 transmission1 r\t+1 or  
/orage ( ! data conta9+ s5sitive acc\nt 
in=mation or s5sitive p]sonal in=mation1
 if su* cov]$ entity c be reasonably    
id5tifi$4 ,if a s]vice provid] is act+  
solely z a s]vice provid] = purposes (  
?is subsection1 ! s]vice provid] has no 
o!r notification obligations "u ?is     
section4  7,b7 ,cov]$ entities :o       
receive notice f c>ri]s ,^u receiv+     
notification f a s]vice provid] "u      
p>agraph 7#a71 a cov]$ entity %all      
provide notification z requir$ "u ?is   
section4  7#c7 ,communications ) acc\nt 
hold]s ,if a cov]$ entity t is n a      
f9ancial in/itution exp]i5ces a brea* ( 
data security involv+ s5sitive acc\nt   
in=mation1 a f9ancial in/itution t      
issues an acc\nt to :i* ! s5sitive      
acc\nt in=mation relates may communicate
 ) ! acc\nt hold] reg>d+ ! brea*1       

includ+--  7,a7 an explanation t !      
f9ancial in/itution 0 n brea*$1 & t !   
brea* occurr$ at a ?ird-p>ty t _h access
 to ! consum]'s s5sitive acc\nt         
in=mation2 or  7,b7 id5tify ! cov]$     
entity t exp]i5c$ ! brea* aft] ! cov]$  
entity has provid$ notice consi/5t ) ?is
 ,act4  7f7 ,compliance  7#a7 ,9 g5]al  
,an entity %all be deem$ to be 9        
compliance )-- 7,a7 9 ! case ( a        
f9ancial in/itution--  7i7 subsection   
7a71 if ! f9ancial in/itution ma9ta9s   
policies & proc$ures to protect !       
confid5tiality & security ( s5sitive    
acc\nt in=mation & s5sitive p]sonal     
in=mation t are consi/5t ) ! policies & 
proc$ures ( ! f9ancial in/itution t are 
design$ to comply ) ! requirem5ts (     
section #eja7;b7 ( !                    
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja7;b77 & any regulations or        
guidance prescrib$ "u t section t are   
applicable to ! f9ancial in/itution2 &  
7ii7 subsections 7b7 & 7c71 if !        
f9ancial in/itution--  7,i7 7aa7 ma9ta9s

 policies & proc$ures to inve/igate &   
provide notice to consum]s ( brea*es (  
data security t are consi/5t ) !        
policies & proc$ures ( ! f9ancial       
in/itution t are design$ to comply ) !  
inve/igation & notice requirem5ts       
e/abli%$ by regulations or guidance "u  
section #eja7;b7 ( !                    
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja7;b77 t are applicable to !       
f9ancial in/itution2  7bb7 is an        
affiliate ( a bank hold+ company t      
ma9ta9s policies & proc$ures to         
inve/igate & provide notice to consum]s 
( brea*es ( data security t are consi/5t
 ) ! policies & proc$ures ( a bank t is 
an affiliate ( ! f9ancial in/itution1 & 
! policies & proc$ures ( ! bank are     
design$ to comply ) ! inve/igation &    
notice requirem5ts e/abli%$ by any      
regulations or guidance "u section      
#eja7;b7 ( ! ,gramm-,lea*-,bliley ,act  
7#ae ,u4,s4,c4 #fhja7;b77 t are         
applicable to ! bank2 or  7cc7 7,,aa7 is
 an affiliate ( a sav+s & loan hold+    

company t ma9ta9s policies & proc$ures  
to inve/igate & provide notice to       
consum]s ( data brea*es ( data security 
t are consi/5t ) ! policies & proc$ures 
( a sav+s association t is an affiliate 
( ! f9ancial in/itution2 & 7,,bb7 !     
policies & proc$ures ( ! sav+s          
association are design$ to comply ) !   
inve/igation & notice requirem5ts       
e/abli%$ by any regulations or guidel9es
 "u section #eja7;b7 ( !                
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4   
#fhja7;b77 t are applicable to sav+s    
associations2 &  7,,ii7 provides =      
notice to ! entities describ$ "u        
subp>agraphs 7,b71 7,c71 & 7,d7 (       
subsection 7c77#a71 if notice is provid$
 to consum]s pursuant to ! policies &   
proc$ures ( ! f9ancial in/itution       
describ$ 9 subclause 7,i72 &  7,b7      
subsections 7a71 7b71 & 7c7-- 7i7 if !  
entity is a cov]$ entity = purposes ( ! 
regulations promulgat$ "u section       
#bfd7;c7 ( ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    

#aiif 7#db ,u4,s4,c4 #acbj;d-#b note71  
to ! ext5t t ! entity is 9 compliance ) 
su* regulations2 or  7ii7 if ! entity is
 9 compliance ) sections #acdjb & #acdjg
 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agicb 
& #agicg74  7#b7 ,def9itions ,9 ?is     
subsection-- 7,a7 ! t]ms bank hold+     
company & bank h ! mean+s giv5 ! t]ms 9 
section #b ( ! ,bank ,hold+ ,company    
,act ( #aief 7#ab ,u4,s4,c4 #ahda72     
7,b7 ! t]m sav+s & loan hold+ company   
has ! mean+ giv5 ! t]m 9 section #aj ( !
 ,home ,own]s' ,loan ,act 7#ab ,u4,s4,c4
 #adfg;a72 &  7,c7 ! t]m sav+s          
association has ! mean+ giv5 ! t]m 9    
section #b ( ! ,home ,own]s' ,loan ,act 
7#ab ,u4,s4,c4 #adfb74  #e4             
,adm9i/rative en=cem5t  7a7 ,9 g5]al    
,not)/&+ any o!r provision ( law section
 #d %all be en=c$ exclusively "u-- 7#a7 
section #h ( ! ,f$]al ,deposit          
,insurance ,act 7#ab ,u4,s4,c4 #ahah71 9
 ! case (--  7,a7 a national bank1 a    
,f$]al bran* or ,f$]al ag5cy ( a =eign  
bank1 or any subsidi>y !re( 7o!r ?an a  

brok]1 deal]1 p]son provid+ insurance1  
inve/m5t company1 or inve/m5t advis]71  
or a sav+s association1 ! deposits ( :i*
 are insur$ by ! ,f$]al ,deposit        
,insurance ,corporation1 or any         
subsidi>y !re( 7o!r ?an a brok]1 deal]1 
p]son provid+ insurance1 inve/m5t       
company1 or inve/m5t advis]71 by !      
,(fice ( ! ,comptroll] ( ! ,curr5cy2    
7,b7 a memb] bank ( ! ,f$]al ,res]ve    
,sy/em 7o!r ?an a national bank71 a     
bran* or ag5cy ( a =eign bank 7o!r ?an a
 ,f$]al bran*1 ,f$]al ag5cy1 or insur$  
,/ate bran* ( a =eign bank71 a comm]cial
 l5d+ company own$ or controll$ by a    
=eign bank1 an organization op]at+ "u   
section #be or #be;,a ( ! ,f$]al ,res]ve
 ,act 7#ab ,u4,s4,c4 #fja1 #faa71 or a  
bank hold+ company & its nonbank        
subsidi>y or affiliate 7o!r ?an a brok]1
 deal]1 p]son provid+ insurance1        
inve/m5t company1 or inve/m5t advis]71  
by ! ,bo>d ( ,gov]nors ( ! ,f$]al       
,res]ve ,sy/em2 &  7,c7 a bank1 !       
deposits ( :i* are insur$ by ! ,f$]al   

,deposit ,insurance ,corporation 7o!r   
?an a memb] ( ! ,f$]al ,res]ve ,sy/em71 
an insur$ ,/ate bran* ( a =eign bank1 or
 any subsidi>y !re( 7o!r ?an a brok]1   
deal]1 p]son provid+ insurance1 inve/m5t
 company1 or inve/m5t advis]71 by !     
,bo>d ( ,directors ( ! ,f$]al ,deposit  
,insurance ,corporation2  7#b7 ! ,f$]al 
,cr$it ,union ,act 7#ab ,u4,s4,c4 #agea 
et seq471 by ! ,national ,cr$it ,union  
,adm9i/ration ,bo>d ) respect to any    
f$]ally insur$ cr$it union2  7#c7 !     
,securities ,ex*ange ,act ( #aicd 7#ae  
,u4,s4,c4 #gh;a et seq471 by !          
,securities & ,ex*ange ,commission )    
respect to any brok] or deal]2  7#d7 !  
,inve/m5t ,company ,act ( #aidj 7#ae    
,u4,s4,c4 #hj;a-#a et seq471 by !       
,securities & ,ex*ange ,commission )    
respect to any inve/m5t company2  7#e7 !
 ,inve/m5t ,advis]s ,act ( #aidj 7#ae   
,u4,s4,c4 #hj;b-#a et seq471 by !       
,securities & ,ex*ange ,commission )    
respect to any inve/m5t advis] regi/]$ )
 ! ,securities & ,ex*ange ,commission "u

 t ,act2  7#f7 ! ,commodity ,ex*ange    
,act 7#g ,u4,s4,c4 #a et seq471 by !    
,commodity ,futures ,trad+ ,commission )
 respect to any futures commission      
m]*ant1 commodity trad+ advisor1        
commodity pool op]ator1 or introduc+    
brok]2  7#g7 ! provisions ( title ,,xiii
 ( ! ,h\s+ & ,community ,developm5t ,act
 ( #aiib 7#ab ,u4,s4,c4 #deja et seq471 
by ! ,director ( ,f$]al ,h\s+ ,ent]prise
 ,ov]sight 7& any successor to !        
functional regulatory ag5cy7 ) respect  
to ! ,f$]al ,national ,mortgage         
,association1 ! ,f$]al ,home ,loan      
,mortgage ,corporation1 & any o!r entity
 or ent]prise 7z def9$ 9 t title7       
subject to ! jurisdiction ( ! functional
 regulatory ag5cy "u t title1 includ+   
any affiliate ( any ! ent]prise2  7#h7  
,/ate insurance law1 9 ! case ( any     
p]son engag$ 9 provid+ insurance1 by !  
applicable ,/ate insurance au?ority ( ! 
,/ate 9 :i* ! p]son is domicil$2 &  7#i7
 ! ,f$]al ,trade ,commission ,act 7#ae  
,u4,s4,c4 #da et seq471 by ! ,commission

 = any o!r cov]$ entity t is n subject  
to ! jurisdiction ( any ag5cy or        
au?ority describ$ "u p>agraphs 7#a7     
?r\gh 7#h71 includ+--  7,a7 not)/&+     
section #e7;a77#b7 ( ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b771 common c>ri]s subject to !
 ,communications ,act ( #aicd 7#dg      
,u4,s4,c4 #aea et seq472  7,b7 not)/&+ !
 ,f$]al ,aviation ,act ( #aieh 7#di     
,u4,s4,c4 ,app4 #acja et seq471 include 
! au?ority to en=ce compliance by air   
c>ri]s & =eign air c>ri]s2 &  7,c7      
not)/&+ ! ,pack]s & ,/ocky>ds ,act 7#g  
,u4,s4,c4 #aha et seq471 include !      
au?ority to en=ce compliance by p]sons1 
p>tn]%ips1 & corporations subject to !  
provisions ( t ,act4  7b7 ,application  
to cable op]ators1 satellite op]ators1 &
 telecommunications c>ri]s  7#a7 ,data  
security & brea* notification ,sections 
#bja1 #bjb1 #bbb1 #cch1 & #fca ( !      
,communications ,act ( #aicd 7#dg       
,u4,s4,c4 #bja1 #bjb1 #bbb1 #cch1 &     
#eea71 & any regulations promulgat$ 9   

accordance ) ^? sections1 %all n apply )
 respect to ! in=mation security        
practices1 includ+ practices relat+ to !
 notification ( unau?oriz$ access to    
data 9 electronic =m1 ( any cov]$ entity
 o!rwise subject to ^? sections4  7#b7  
,rule ( con/ruction ,no?+ 9 ?is         
subsection o!rwise limits au?ority ( !  
,f$]al ,communication ,commission )     
respect to sections #bja1 #bjb1 #bbb1   
#cch1 & #fca ( ! ,communications ,act ( 
#aicd 7#dg ,u4,s4,c4 #bja1 #bjb1 #bbb1  
#cch1 & #eea74  7c7 ,no private "r (    
action  7#a7 ,9 g5]al ,?is ,act may n be
 con/ru$ to provide a private "r (      
action1 includ+ a class action ) respect
 to any ,act or practice regulat$ "u ?is
 ,act4  7#b7 ,exception ,a consum] or   
entity t suff]s f9ancial h>m z a result 
( a cov]$ entity's violation ( ?is ,act 
may br+ an action 9 a di/rict c\rt ( !  
,unit$ ,/ates = ! judicial di/rict 9 :i*
 ! consum] or entity suff]$ ! h>m aga9/ 
! cov]$ entity to recov]--  7,a7 9 !    
case ( a neglig5t violation ( ?is ,act1 

actual f9ancial damages1 c\rt co/s all[$
 by ! rules ( ! c\rt1 & reasonable      
attorney's fees2 &  7,b7 9 ! case ( a   
kn[+ violation ( ?is ,act1 ! damages1   
co/s1 & attorney's fees describ$ 9      
subp>agraph 7,a7 ( ?is subsection &     
punitive damages4  #f4 ,relation to     
,/ate law ,no requirem5t or prohibition 
may be impos$ "u ! laws ( any ,/ate )   
respect to ! responsibilities ( any     
p]son to--  7#a7 protect ! security (   
in=mation relat+ to consum]s t is       
ma9ta9$1 communicat$1 or o!rwise h&l$   
by1 or on behalf (1 ! p]son2  7#b7      
safegu>d in=mation relat+ to consum]s   
f-- 7,a7 unau?oriz$ access2 &  7,b7     
unau?oriz$ acquisition2  7#c7 inve/igate
 or provide notice ( ! unau?oriz$       
acquisition (1 or access to1 in=mation  
relat+ to consum]s1 or ! pot5tial misuse
 ( ! in=mation1 = fraudul5t1 illegal1 or
 o!r purposes2 or  7#d7 mitigate any    
pot5tial or actual loss or h>m result+ f
 ! unau?oriz$ acquisition (1 or access  
to1 in=mation relat+ to consum]s4  #g4  

,delay$ effective date = c]ta9          
provisions ,sections #d & #f %all take  
effect #a ye> aft] ! date ( enactm5t (  
?is ,act4