,i #aae? ,,congress #a/ ,session ,h4 ,r4 #chjf ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,septemb] #ah1 #bjag,mr4 ,langev9 7= himself & ,mr4 ,t$ ,lieu ( ,cali=nia7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,en]gy & ,comm]ce1 & 9 addition to ! ,committee on ! ,judici>y1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,a ,,bill ,to e/abli% a national data brea* notification /&>d1 & = o!r purposes4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,p]sonal ,data ,notification & ,protection ,act ( #bjag4 7b7 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4 ,sec4 #b4 ,notification to individuals4 ,sec4 #c4 ,exemptions f notification to individuals4 ,sec4 #d4 ,me?ods ( notification4 ,sec4 #e4 ,cont5t ( notification4 ,sec4 #f4 ,coord9ation ( notification ) cr$it report+ ag5cies4 ,sec4 #g4 ,notification = law en=cem5t & o!r purposes4 ,sec4 #h4 ,en=cem5t by ! ,f$]al ,trade ,commission4 ,sec4 #i4 ,en=cem5t by ,/ate attorneys g5]al4 ,sec4 #aj4 ,effect on ,/ate law4 ,sec4 #aa4 ,report+ on security brea*es4 ,sec4 #ab4 ,exclud$ bus9ess entities4 ,sec4 #ac4 ,def9itions4 ,sec4 #ad4 ,effective date4 #b4 ,notification to individuals 7a7 ,9 g5]al ,except z provid$ = 9 section #c1 any bus9ess entity engag$ 9 or affect+ int]/ate comm]ce1 t uses1 accesses1 transmits1 /ores1 disposes (1 or collects s5sitive p]sonally id5tifiable in=mation ab\t m ?an #aj1jjj individuals dur+ any #ab-mon? p]iod %all1 foll[+ ! discov]y ( a security brea* ( su* in=mation1 notify1 9 accordance ) sections #d & #e1 any individual ^: s5sitive p]sonally id5tifiable in=mation has be51 or is reasonably believ$ to h be51 access$ or acquir$4 7b7 ,obligations ( & to own] or lic5see 7#a7 ,notification to own] or lic5see ,any bus9ess entity engag$ 9 or affect+ int]/ate comm]ce1 t uses1 accesses1 transmits1 /ores1 disposes (1 or collects s5sitive p]sonally id5tifiable in=mation t ! bus9ess entity does n own or lic5se %all notify ! own] or lic5see ( ! in=mation foll[+ ! discov]y ( a security brea* involv+ su* in=mation1 unless !re is no reasonable risk ( h>m or fraud to su* own] or lic5see4 7#b7 ,notification by own]1 lic5see1 or o!r designat$ ?ird p>ty ,no?+ 9 ?is ,act %all prev5t or abrogate an agreem5t betwe5 a bus9ess entity requir$ to provide notification "u ?is section & a designat$ ?ird p>ty1 includ+ an own] or lic5see ( ! s5sitive p]sonally id5tifiable in=mation subject to ! security brea*1 to provide ! notifications requir$ "u subsection 7a74 7#c7 ,bus9ess entity reliev$ f giv+ notification ,a bus9ess entity requir$ to provide notification "u subsection 7a7 %all n be requir$ to provide su* notification if an own] or lic5see ( ! s5sitive p]sonally id5tifiable in=mation subject to ! security brea*1 or o!r designat$ ?ird p>ty1 provides su* notification4 7c7 ,timel9ess ( notification 7#a7 ,9 g5]al ,all notifications requir$ "u ?is section %all be made )\t unreasonable delay foll[+ ! discov]y by ! bus9ess entity ( a security brea*4 ,a bus9ess entity %all1 ^u ! reque/ ( ! ,commission1 provide records or o!r evid5ce ( ! notifications requir$ "u ?is section4 7#b7 ,reasonable delay 7,a7 ,9 g5]al ,except z provid$ 9 subsection 7d71 reasonable delay "u ?is subsection %all n exce$ #cj days1 unless ! bus9ess entity seek+ additional "t reque/s an ext5sion ( "t & ! ,commission det]m9es t additional "t is reasonably necess>y to det]m9e ! scope ( ! security brea*1 prev5t fur!r disclosures1 conduct ! risk assessm5t1 re/ore ! reasonable integrity ( ! data sy/em1 or provide notice to ! brea* notification entity4 7,b7 ,ext5sion ,if ! ,commission det]m9es t additional "t is reasonably necess>y z describ$ 9 subp>agraph 7,a71 ! ,commission may ext5d ! "t p]iod = notification = additional p]iods ( up to #cj days ea*4 ,any su* ext5sion %all be provid$ 9 writ+ by ! ,commission4 7#c7 ,burd5 ( production ,if a bus9ess entity requires additional "t "u p>agraph 7#b71 ! bus9ess entity %all provide ! ,commission ) records or o!r evid5ce ( ! reasons necessitat+ delay ( notification4 7d7 ,delay ( notification = law en=cem5t or national security 7#a7 ,9 g5]al ,if ! ,director ( ! ,unit$ ,/ates ,secret ,s]vice or ! ,director ( ! ,f$]al ,bureau ( ,inve/igation det]m9es t ! notification requir$ "u ?is section w\ld imp$e a crim9al inve/igation or national security activity1 ! "t p]iod = notification %all be ext5d$ #cj days ^u writt5 notice f su* ,director to ! bus9ess entity t exp]i5c$ ! brea*4 7#b7 ,ext5d$ delay ( notification ,if ! "t p]iod = notification requir$ "u subsection 7a7 is ext5d$ pursuant to p>agraph 7#a71 a bus9ess entity %all provide ! notification )9 su* "t p]iod unless ! ,director ( ! ,unit$ ,/ates ,secret ,s]vice or ! ,director ( ! ,f$]al ,bureau ( ,inve/igation provides writt5 notification t fur!r ext5sion ( ! "t p]iod is necess>y4 ,! ,director ( ! ,unit$ ,/ates ,secret ,s]vice or ! ,director ( ! ,f$]al ,bureau ( ,inve/igation may ext5d ! "t p]iod = additional p]iods ( up to #cj days ea*4 7#c7 ,immunity ,no cause ( action = :i* jurisdiction is bas$ "u section #acdf7;b7 ( title #bh1 ,unit$ ,/ates ,code1 %all lie aga9/ any ,f$]al law en=cem5t ag5cy = acts relat+ to ! ext5sion ( ! deadl9e = notification = law en=cem5t or national security purposes "u ?is section4 7e7 ,designation ( brea* notification entity ,n lat] ?an #fj days aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y ( ,homel& ,security %all designate a ,f$]al ,gov]nm5t entity to receive notices1 reports1 & in=mation ab\t in=mation security incid5ts1 ?reats1 & vuln]abilities "u ?is ,act4 #c4 ,exemptions f notification to individuals 7a7 ,exemption = national security & law en=cem5t 7#a7 ,9 g5]al ,not)/&+ section #b1 if ! ,director ( ! ,unit$ ,/ates ,secret ,s]vice or ! ,director ( ! ,f$]al ,bureau ( ,inve/igation det]m9es t notification ( ! security brea* requir$ by su* section c\ld be expect$ to reveal s5sitive s\rces & me?ods or simil>ly imp$e ! ability ( a ,f$]al1 ,/ate1 or local law en=cem5t ag5cy to conduct law en=cem5t inve/igations1 or if ! ,director ( ! ,f$]al ,bureau ( ,inve/igation det]m9es t notification ( ! security brea* c\ld be expect$ to cause damage to national security1 su* notification is n requir$4 7#b7 ,immunity ,no cause ( action = :i* jurisdiction is bas$ "u section #acdf7;b7 ( title #bh1 ,unit$ ,/ates ,code1 %all lie aga9/ any ,f$]al law en=cem5t ag5cy = acts relat+ to provision ( an exemption f notification = law en=cem5t or national security purposes "u ?is section4 7b7 ,safe h>bor 7#a7 ,9 g5]al ,a bus9ess entity is exempt f ! notification requirem5t "u section #b1 if ! foll[+ requirem5ts are met3 7,a7 ,risk assessm5t ,a risk assessm5t1 9 accordance ) p>agraph 7#c71 is conduct$ by or on behalf ( ! bus9ess entity t concludes t !re is no reasonable risk t a security brea* has result$ 91 or w result 91 h>m to ! individuals ^: s5sitive p]sonally id5tifiable in=mation 0 subject to ! security brea*4 7,b7 ,notice to ,commission ,)\t unreasonable delay & n lat] ?an #cj days aft] ! discov]y ( a security brea*1 unless ext5d$ by ! ,commission1 ! ,director ( ! ,unit$ ,/ates ,secret ,s]vice1 or ! ,director ( ! ,f$]al ,bureau ( ,inve/igation "u section #b 79 :i* case1 be=e ! ext5d$ deadl9e71 ! bus9ess entity notifies ! ,commission1 9 writ+1 (-- 7i7 ! results ( ! risk assessm5t2 & 7ii7 ! decision by ! bus9ess entity to invoke ! risk assessm5t exemption describ$ "u subp>agraph 7,a74 7,c7 ,det]m9ation by ,commission ,dur+ ! p]iod beg9n+ on ! date on :i* ! notification describ$ 9 subp>agraph 7,b7 is submitt$ & end+ #aj days aft] su* date1 ! ,commission has n issu$ a det]m9ation 9 writ+ t a notification %\ld be provid$ "u section #b4 7#b7 ,rebuttable presumption ,= purposes ( p>agraph 7#a7-- 7,a7 ! r5d]+ ( s5sitive p]sonally id5tifiable in=mation at issue unusable1 unreadable1 or indeciph]able ?r\gh a security te*nology g5]ally accept$ by exp]ts 9 ! field ( in=mation security %all e/abli% a rebuttable presumption t su* reasonable risk does n exi/2 & 7,b7 any su* presumption %all be rebuttable by facts demon/rat+ t ! security te*nologies or me?odologies 9 a specific case h be51 or are reasonably likely to h be51 compromis$4 7#c7 ,risk assessm5t requirem5ts ,a risk assessm5t is 9 accordance ) ?is p>agraph if ! foll[+ requirem5ts are met3 7,a7 ,prop]ly conduct$ ,! risk assessm5t is conduct$ 9 a reasonable mann] or accord+ to /&>ds g5]ally accept$ by exp]ts 9 ! field ( in=mation security4 7,b7 ,logg+ data requir$ ,! risk assessm5t includes logg+ data1 z applicable & to ! ext5t available1 = a p]iod ( at lea/ six mon?s be=e ! discov]y ( a security brea* describ$ 9 section #b7;a7-- 7i7 = ea* communication or attempt$ communication ) a database or data sy/em conta9+ s5sitive p]sonally id5tifiable in=mation1 ! data sy/em communication in=mation = ! communication or attempt$ communication1 includ+ any ,int]net addresses1 & ! date & "t associat$ ) ! communication or attempt$ communication2 & 7ii7 all log-9 in=mation associat$ ) databases or data sy/ems conta9+ s5sitive p]sonally id5tifiable in=mation1 includ+ bo? adm9i/rator & us] log-9 in=mation4 7,c7 ,fraudul5t or mislead+ in=mation ,! risk assessm5t does n conta9 fraudul5t or delib]ately mislead+ in=mation4 7c7 ,f9ancial fraud prev5tion exemption 7#a7 ,9 g5]al ,a bus9ess entity is exempt f ! notification requirem5t "u section #b if ! bus9ess entity uses or p>ticipates 9 a security program t-- 7,a7 effectively blocks ! use ( ! s5sitive p]sonally id5tifiable in=mation to initiate unau?oriz$ f9ancial transactions be=e !y are *>g$ to ! acc\nt ( ! individual2 & 7,b7 provides notification to affect$ individuals aft] a security brea* t has result$ 9 fraud or unau?oriz$ transactions4 7#b7 ,limitation ,! exemption 9 p>agraph 7#a7 does n apply if ! in=mation subject to ! security brea* includes ! individual's fir/ & la/ "n or any o!r type ( s5sitive p]sonally id5tifiable in=mation o!r ?an a cr$it c>d numb] or cr$it c>d security code4 #d4 ,me?ods ( notification ,a bus9ess entity %all be 9 compliance ) ! requirem5ts ( ?is section if1 ) respect to ! me?od ( notification z requir$ "u section #b1 ! foll[+ requirem5ts are met3 7#a7 ,individual notification ,notification to an individual is by "o ( ! foll[+ means3 7,a7 ,writt5 notification to ! la/ kn[n home mail+ address ( ! individual 9 ! records ( ! bus9ess entity4 7,b7 ,telephone notification to ! individual p]sonally4 7,c7 ,e-mail notification1 if ! individual has cons5t$ to receive su* notification & ! notification is consi/5t ) ! provisions p]mitt+ electronic transmission ( notifications "u section #aja ( ! ,electronic ,signatures 9 ,global & ,national ,comm]ce ,act 7#ae ,u4,s4,c4 #gjja74 7#b7 ,m$ia notification ,if ! numb] ( resid5ts ( a ,/ate ^: s5sitive p]sonally id5tifiable in=mation 01 or is reasonably believ$ to h be51 access$ or acquir$ by an unau?oriz$ p]son exce$s #e1jjj1 notification is provid$ to m$ia reasonably calculat$ to rea* su* individuals1 su* z major m$ia outlets s]v+ a ,/ate or jurisdiction4 #e4 ,cont5t ( notification ,! notification provid$ to individuals requir$ by section #b %all include1 to ! ext5t possible1 ! foll[+3 7#a7 ,a description ( ! categories ( s5sitive p]sonally id5tifiable in=mation t 01 or is reasonably believ$ to h be51 access$ or acquir$ by an unau?oriz$ p]son4 7#b7 ,a toll-free numb]-- 7,a7 t ! individual may use to contact ! bus9ess entity1 or ! ag5t ( ! bus9ess entity2 & 7,b7 f :i* ! individual may le>n :at types ( s5sitive p]sonally id5tifiable in=mation ! bus9ess entity ma9ta9$ ab\t t individual4 7#c7 ,! toll-free contact telephone numb]s & addresses = ! major cr$it report+ ag5cies & ! ,commission4 7#d7 ,! "n ( ! bus9ess entity t has a direct bus9ess relation%ip ) ! individual4 7#e7 ,not)/&+ section #aj1 any in=mation reg>d+ victim protection assi/ance requir$ by ! ,/ate 9 :i* ! individual resides4 #f4 ,coord9ation ( notification ) cr$it report+ ag5cies 7a7 ,requirem5t ,to notify cr$it report+ ag5cies ,if a bus9ess entity is requir$ to notify m ?an #e1jjj individuals "u section #b1 ! bus9ess entity %all also notify ea* consum] report+ ag5cy t compiles & ma9ta9s files on consum]s on a nationwide basis 7z def9$ 9 section #fjc7p7 ( ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha;a7p777 ( ! tim+ & di/ribution ( ! notifications4 ,su* notification %all be giv5 to ! consum] cr$it report+ ag5cies )\t unreasonable delay &1 if x w n delay notification to ! affect$ individuals1 prior to ! di/ribution ( notifications to ! affect$ individuals4 7b7 ,reasonable delay ,reasonable delay "u subsection 7a7 %all n exce$ #cj days foll[+ ! discov]y ( a security brea*1 except z provid$ 9 subsection 7c7 or 7d7 ( section #b 79 :i* case1 be=e ! ext5d$ deadl9e71 or unless ! bus9ess entity provid+ notification c demon/rate to ! ,commission t additional "t is reasonably necess>y to det]m9e ! scope ( ! security brea*1 prev5t fur!r disclosures1 conduct ! risk assessm5t1 re/ore ! reasonable integrity ( ! data sy/em1 & provide notice to ! brea* notification entity4 ,if ! ,commission det]m9es t additional "t is necess>y1 ! ,commission may ext5d ! "t p]iod = notification = additional p]iods ( up to #cj days ea*4 ,any su* ext5sion %all be provid$ 9 writ+4 #g4 ,notification = law en=cem5t & o!r purposes 7a7 ,notification to law en=cem5t & national security au?orities ,any bus9ess entity %all notify ! brea* notification entity1 & ! brea* notification entity %all promptly notify & provide t in=mation to ! ,unit$ ,/ates ,secret ,s]vice1 ! ,f$]al ,bureau ( ,inve/igation1 & ! ,commission = civil law en=cem5t purposes1 & %all make x available z appropriate to o!r ,f$]al ag5cies = law en=cem5t1 national security1 or comput] security purposes1 if-- 7#a7 ! numb] ( individuals ^: s5sitive p]sonally id5tifiable in=mation 01 or is reasonably believ$ to h be51 access$ or acquir$ by an unau?oriz$ p]son exce$s #e1jjj2 7#b7 ! security brea* involves a database1 network$ or integrat$ databases1 or o!r data sy/em conta9+ ! s5sitive p]sonally id5tifiable in=mation ( m ?an #ejj1jjj individuals nationwide2 7#c7 ! security brea* involves databases own$ by ! ,f$]al ,gov]nm5t2 or 7#d7 ! security brea* involves prim>ily s5sitive p]sonally id5tifiable in=mation ( individuals kn[n to ! bus9ess entity to be employees & contractors ( ! ,f$]al ,gov]nm5t involv$ 9 national security or law en=cem5t4 7b7 ,regulations ,n lat] ?an "o ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations 79 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code71 9 consultation ) ! ,attorney ,g5]al & ! ,secret>y ( ,homel& ,security1 t describe :at in=mation is requir$ to be includ$ 9 ! notification "u subsection 7a74 ,9 addition1 ! ,commission %all1 z necess>y1 promulgate regulations 79 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code71 9 consultation ) ! ,attorney ,g5]al1 to adju/ ! ?re%olds = notification to law en=cem5t & national security au?orities "u subsection 7a7 & to facilitate ! purposes ( ?is section4 7c7 ,tim+ ( notification ,! notification requir$ "u ?is section %all be provid$ z promptly z possible & at lea/ #gb h\rs be=e notification ( an individual pursuant to section #b or #aj days aft] discov]y ( ! brea* requir+ notification1 :i*ev] comes fir/4 #h4 ,en=cem5t by ! ,f$]al ,trade ,commission 7a7 ,unfair or deceptive acts or practices ,a violation ( ?is ,act or a regulation promulgat$ "u ?is ,act %all be treat$ z a violation ( a regulation "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices4 7b7 ,p[]s ( ,commission ,! ,f$]al ,trade ,commission %all en=ce ?is ,act & ! regulations promulgat$ "u ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act1 except t ! exceptions describ$ 9 section #e7;a77#b7 ( su* ,act 7#ae ,u4,s4,c4 #de7;a77#b77 %all n apply4 ,any bus9ess entity :o violates ?is ,act or a regulation promulgat$ "u ?is ,act %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act4 7c7 ,f$]al ,communications ,commission ,9 a case 9 :i* en=cem5t "u ?is ,act involves a bus9ess entity t is subject to ! au?ority ( ! ,f$]al ,communications ,commission1 9 en=cem5t actions by ! ,commission1 ! ,commission %all consult ) ! ,f$]al ,communications ,commission4 7d7 ,consum] ,f9ancial ,protection ,bureau ,9 a case 9 :i* en=cem5t "u ?is ,act relates to f9ancial in=mation or in=mation associat$ ) ! provision ( a consum] f9ancial product or s]vice1 9 en=cem5t actions by ! ,commission1 ! ,commission %all consult ) ! ,consum] ,f9ancial ,protection ,bureau4 7e7 ,consultation ) ! ,attorney ,g5]al requir$ ,! ,commission %all consult ) ! ,attorney ,g5]al be=e op5+ an inve/igation4 ,if ! ,attorney ,g5]al det]m9es t su* an inve/igation w\ld imp$e an ongo+ crim9al inve/igation or national security activity1 ! ,commission may n op5 su* inve/igation4 7f7 ,regulations 7#a7 ,9 g5]al ,! ,commission may promulgate regulations1 9 addition to ! regulations promulgat$ pursuant to section #g7;b71 relat+ to ! duties ( ! ,commission "u ?is ,act1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 z ! ,commission det]m9es to be necess>y to c>ry out ?is ,act4 7#b7 ,f$]al ,communications ,commission ,) reg>d to a regulation promulgat$ "u ?is section t relates to an entity subject to ! au?ority ( ! ,f$]al ,communications ,commission1 ! ,commission may only promulgate su* regulation aft] consultation ) ! ,f$]al ,communications ,commission4 7#c7 ,consum] ,f9ancial ,protection ,bureau ,) reg>d to a regulation promulgat$ "u ?is section t relates to f9ancial in=mation or in=mation associat$ ) ! provision ( a consum] f9ancial product or s]vice1 ! ,commission may only promulgate su* regulation aft] consultation ) ! ,consum] ,f9ancial ,protection ,bureau4 #i4 ,en=cem5t by ,/ate attorneys g5]al 7a7 ,9 g5]al 7#a7 ,civil actions ,9 any case 9 :i* ! attorney g5]al ( a ,/ate or an (ficial or ag5cy ( a ,/ate has reason to believe t an int]e/ ( ! resid5ts ( t ,/ate has be5 or is ?reat5$ or adv]sely affect$ by an act or practice 9 violation ( ?is ,act or a regulation promulgat$ "u ?is ,act1 ! ,/ate1 z p>5s patriae1 may br+ a civil action on behalf ( ! resid5ts ( ! ,/ate 9 an appropriate ,/ate c\rt or an appropriate di/rict c\rt ( ! ,unit$ ,/ates to-- 7,a7 enjo9 t practice2 7,b7 en=ce compliance ) ?is ,act2 or 7,c7 impose civil p5alties ( n m ?an #a1jjj p] day p] individual ^: s5sitive p]sonally id5tifiable in=mation 01 or is reasonably believ$ to h be51 access$ or acquir$ by an unau?oriz$ p]son1 up to a maximum ( #a1jjj1jjj p] violation1 unless su* conduct is f\nd to be willful or int5tional4 7#b7 ,notice ,be=e fil+ an action "u p>agraph 7#a71 ! attorney g5]al1 (ficial1 or ag5cy ( ! ,/ate involv$ %all provide to ! ,attorney ,g5]al & ! ,commission-- 7,a7 a writt5 notice ( ! action2 & 7,b7 a copy ( ! compla9t = ! action4 7#c7 ,attorney ,g5]al c]tification ,an action may n be fil$ "u p>agraph 7#a7 if ! ,attorney ,g5]al det]m9es t ! fil+ w\ld imp$e a crim9al inve/igation or national security activity4 7b7 ,au?ority ( ,f$]al ,trade ,commission ,^u receiv+ notice "u subsection 7a77#b71 ! ,commission may-- 7#a7 move to /ay ! action1 p5d+ ! f9al disposition ( a p5d+ ,f$]al proce$+ or action2 7#b7 initiate an action 9 ! appropriate ,unit$ ,/ates di/rict c\rt "u section #h & move to consolidate all p5d+ actions1 includ+ ,/ate actions1 9 su* c\rt2 7#c7 int]v5e 9 ! action br\ght "u subsection 7a72 or 7#d7 file petitions = appeal4 7c7 ,p5d+ proce$+s ,if ! ,commission has in/itut$ a proce$+ or action = a violation ( ?is ,act or any regulations promulgat$ "u ?is ,act1 a ,/ate attorney g5]al1 (ficial1 or ag5cy may n br+ an action "u ?is ,act dur+ ! p5d5cy ( ! ,f$]al proce$+ or action aga9/ any def5dant nam$ 9 su* proce$+ or action = any violation t is alleg$ 9 su* proce$+ or action4 7d7 ,con/ruction ,= purposes ( br++ any civil action "u subsection 7a71 no?+ 9 ?is ,act %all be con/ru$ to prev5t an attorney g5]al1 (ficial1 or ag5cy ( a ,/ate f ex]cis+ ! p[]s conf]r$ on su* attorney g5]al1 (ficial1 or ag5cy by ! laws ( t ,/ate to-- 7#a7 conduct inve/igations2 7#b7 adm9i/] oa?s or affirmations2 or 7#c7 compel ! att5dance ( witnesses or ! production ( docum5t>y & o!r evid5ce4 7e7 ,v5ue2 s]vice ( process 7#a7 ,v5ue ,any action br\ght "u subsection 7a7 may be br\ght 9-- 7,a7 ! di/rict c\rt ( ! ,unit$ ,/ates t meets applicable requirem5ts relat+ to v5ue "u section #acia ( title #bh1 ,unit$ ,/ates ,code2 or 7,b7 ano!r c\rt ( compet5t jurisdiction4 7#b7 ,s]vice ( process ,9 an action br\ght "u subsection 7a71 process may be s]v$ 9 any di/rict 9 :i* ! def5dant-- 7,a7 is an inhabitant2 or 7,b7 may be f\nd4 #aj4 ,effect on ,/ate law ,! provisions ( ?is ,act %all sup]s$e any provision ( ! law ( any ,/ate1 or a political subdivision !re(1 relat+ to notification by a bus9ess entity engag$ 9 int]/ate comm]ce ( a security brea*1 except z provid$ 9 section #e7e74 #aa4 ,report+ on security brea*es 7a7 ,report requir$ on national security & law en=cem5t exemptions ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,director ( ! ,unit$ ,/ates ,secret ,s]vice & ! ,director ( ! ,f$]al ,bureau ( ,inve/igation %all submit to ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate on a report on ! numb] & nature ( security brea*es subject to ! national security & law en=cem5t exemptions "u section #c7;a74 7b7 ,report requir$ on safe h>bor exemptions ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,commission %all submit to ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate a report on ! numb] & nature ( ! security brea*es describ$ 9 ! notices fil$ by bus9ess entities invok+ ! risk assessm5t exemption "u section #c7;b7 & ! response ( ! ,commission to su* notices4 #ab4 ,exclud$ bus9ess entities ,no?+ 9 ?is ,act1 or ! regulations promulgat$ "u ?is ,act1 %all apply to-- 7#a7 bus9ess entities to ! ext5t t su* entities act z cov]$ entities or bus9ess associates 7z su* t]ms are def9$ 9 section #acdjj ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agiba77 subject to section #acdjb ( su* ,act 7#db ,u4,s4,c4 #agicb72 & 7#b7 bus9ess entities to ! ext5t t !y act z v5dors ( p]sonal heal? records 7z su* t]m is def9$ 9 section #acdjj ( su* ,act 7#db ,u4,s4,c4 #agiba77 & ?ird-p>ty s]vice provid]s subject to section #acdjg ( su* ,act 7#db ,u4,s4,c4 #agicg74 #ac4 ,def9itions ,9 ?is ,act3 7#a7 ,brea* notification entity ,! t]m brea* notification entity means ! ,f$]al ,gov]nm5t entity designat$ pursuant to section #b7;e74 7#b7 ,bus9ess entity ,! t]m bus9ess entity means any organization1 corporation1 tru/1 p>tn]%ip1 sole proprietor%ip1 un9corporat$ association1 or v5ture1 :e!r or n e/abli%$ to make a pr(it4 7#c7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#d7 ,consum] f9ancial product or s]vice ,! t]m consum] f9ancial product or s]vice has ! mean+ giv5 t t]m 9 section #ajjb ( ! ,dodd-,frank ,wall ,/reet ,re=m & ,consum] ,protection ,act 7#ab ,u4,s4,c4 #edha74 7#e7 ,data sy/em communication in=mation ,! t]m data sy/em communication in=mation means dial+1 r\t+1 address+1 or signal+ in=mation t id5tifies ! orig91 direction1 de/9ation1 process+1 transmission1 or t]m9ation ( ea* communication initiat$1 attempt$1 or receiv$4 7#f7 ,date & "t ,! t]m date & "t includes ! date1 "t1 & specification ( ! "t zone (fset f ,coord9at$ ,univ]sal ,"t4 7#g7 ,f$]al ag5cy ,! t]m ,f$]al ag5cy has ! mean+ giv5 ! t]m ag5cy 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#h7 ,intellig5ce community ,! t]m intellig5ce community has ! mean+ giv5 t t]m 9 section #c7d7 ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjjc7d774 7#i7 ,int]net address ,! t]m ,int]net address means an ,int]net ,protocol address z specifi$ by ! ,int]net ,protocol v]sion #d or #f protocol1 or any successor protocol or any unique numb] = a specific ho/ on ! ,int]net4 7#aj7 ,security brea* 7,a7 ,9 g5]al ,! t]m security brea* means a compromise ( ! security1 confid5tiality1 or integrity (1 or ! loss (1 comput]iz$ data t results 91 or !re is a reasonable basis to conclude has result$ 9-- 7i7 ! unau?oriz$ acquisition ( s5sitive p]sonally id5tifiable in=mation2 or 7ii7 access to s5sitive p]sonally id5tifiable in=mation t is = an unau?oriz$ purpose1 or 9 excess ( au?orization4 7,b7 ,exclusion ,! t]m security brea* does n include any lawfully au?oriz$ inve/igative1 protective1 or intellig5ce activity ( a law en=cem5t ag5cy ( ! ,unit$ ,/ates1 a ,/ate1 or a political subdivision ( a ,/ate1 or ( an elem5t ( ! intellig5ce community4 7#aa7 ,s5sitive p]sonally id5tifiable in=mation ,! t]m s5sitive p]sonally id5tifiable in=mation means any in=mation or compilation ( in=mation1 9 electronic or digital =m t includes "o or m ( ! foll[+3 7,a7 ,an individual's fir/ & la/ "n or fir/ initial & la/ "n 9 comb9ation ) any two ( ! foll[+ data elem5ts3 7i7 ,home address or telephone numb]4 7ii7 ,"m's maid5 "n4 7iii7 ,mon?1 day1 & ye> ( bir?4 7,b7 ,a ,social ,security numb] 7b n includ+ only ! la/ f\r digits ( a ,social ,security numb]71 driv]'s lic5se numb]1 passport numb]1 or ali5 regi/ration numb] or o!r ,gov]nm5t-issu$ unique id5tification numb]4 7,c7 ,unique biometric data su* z a f+] pr9t1 voice pr9t1 a ret9a or iris image1 or any o!r unique physical repres5tation4 7,d7 ,a unique acc\nt id5tifi]1 includ+ a f9ancial acc\nt numb] or cr$it or debit c>d numb]1 electronic id5tification numb]1 us] "n1 or r\t+ code4 7,e7 ,a us] "n or electronic mail address1 9 comb9ation ) a password or security "q & answ] t w\ld p]mit access to an onl9e acc\nt4 7,f7 ,any comb9ation ( ! foll[+ data elem5ts3 7i7 ,an individual's fir/ & la/ "n or fir/ initial & la/ "n4 7ii7 ,a unique acc\nt id5tifi]1 includ+ a f9ancial acc\nt numb] or cr$it or debit c>d numb]1 electronic id5tification numb]1 us] "n1 or r\t+ code4 7iii7 ,any security code1 access code1 or password1 or s\rce code t c\ld be us$ to g5]ate su* codes or passwords4 7#ab7 ,modifi$ def9ition by rulemak+ ,! ,commission may1 by rule promulgat$ "u section #eec ( title #e1 ,unit$ ,/ates ,code1 am5d ! def9ition ( s5sitive p]sonally id5tifiable in=mation to ! ext5t t su* am5dm5t w accompli% ! purposes ( ?is ,act4 ,9 am5d+ ! def9ition1 ! ,commission may det]m9e-- 7,a7 t any p>ticul> comb9ations ( in=mation are s5sitive p]sonally id5tifiable in=mation2 or 7,b7 t any p>ticul> piece ( in=mation1 on its own1 is s5sitive p]sonally id5tifiable in=mation4 #ad4 ,effective date ,?is ,act %all take effect #ij days aft] ! date ( enactm5t ( ?is ,act4