,i  #aaeth ,,congress  #ast ,session    
,h4 ,r4 #chaf  ,,in ,,the ,,house ,,of  
,,representatives  ,september #ba1      
#bjag,mr4 ,rush introduced the following
 bill2 which was referred to the        
,committee on ,energy and ,commerce  ,a 
,,bill  ,to require notification        
following a breach of security of a     
system containing personal information1 
and for other purposes4  #a4            
,notification of information security   
breach  7a7 ,nationwide notification    
,any person engaged in interstate       
commerce that owns or possesses data in 
electronic form containing personal     
information shall1 following the        
discovery of a breach of security of the
 system maintained by such person that  
contains such data--  7#a7 notify each  
individual who is a citizen or resident 
of the ,united ,states whose personal   
information was acquired or accessed as 
a result of such a breach of security2  
7#b7 notify the ,commission2 and  7#c7  
notify the ,bureau4  7b7 ,special       

notification requirements  7#a7         
,third-party agents ,in the event of a  
breach of security by any third-party   
entity that has been contracted to      
maintain or process data in electronic  
form containing personal information on 
behalf of any other person who owns or  
possesses such data1 such third-party   
entity shall be required to notify such 
person of the breach of security4 ,upon 
receiving such notification from such   
third party1 such person shall provide  
the notification required under         
subsection 7a74  7#b7 ,service providers
 ,if a service provider becomes aware of
 a breach of security of data in        
electronic form containing personal     
information that is owned or possessed  
by another person that connects to or   
uses a system or network provided by the
 service provider for the purpose of    
transmitting1 routing1 or providing     
intermediate or transient storage of    
such data1 such service provider shall  
be required to notify of such a breach  

of security only the person who         
initiated such connection1 transmission1
 routing1 or storage if such person can 
be reasonably identified4 ,upon         
receiving such notification from a      
service provider1 such person shall     
provide the notification required under 
subsection 7a74  7#c7 ,coordination of  
notification with consumer reporting    
agencies ,if a person is required to    
provide notification to more than #a1jjj
 individuals under subsection 7a77#a71  
the person shall also notify the major  
consumer reporting agencies of the      
timing and distribution of the notices4 
,such notice shall be given to the      
consumer reporting agencies without     
unreasonable delay and1 if it will not  
delay notice to the affected            
individuals1 prior to the distribution  
of notices to the affected individuals4 
7c7 ,timeliness of notification  7#a7   
,in general ,unless subject to a delay  
authorized under paragraph 7#b71 a      
notification required under subsection  

7a7 shall be made not later than #cj    
days following the discovery of a breach
 of security1 unless the person         
providing notice can show that providing
 notice within such a timeframe is not  
feasible due to extraordinary           
circumstances necessary to prevent      
further breach or unauthorized          
disclosures1 and reasonably restore the 
integrity of the data system1 in which  
case such notification shall be made as 
promptly as possible4  7#b7 ,delay of   
notification authorized for law         
enforcement or national security        
purposes  7,a7 ,law enforcement ,if a   
,federal1 ,state1 or local law          
enforcement agency determines that the  
notification required under this section
 would impede a civil or criminal       
investigation1 such notification shall  
be delayed upon the written request of  
the law enforcement agency for #cj days 
or such lesser period of time which the 
law enforcement agency determines is    
reasonably necessary and requests in    

writing4 ,a law enforcement agency may1 
by a subsequent written request1 revoke 
such delay or extend the period of time 
set forth in the original request made  
under this paragraph if further delay is
 necessary4  7,b7 ,national security ,if
 a ,federal national security agency or 
homeland security agency determines that
 the notification required under this   
section would threaten national or      
homeland security1 such notification may
 be delayed for a period of time which  
the national security agency or homeland
 security agency determines is          
reasonably necessary and requests in    
writing4 ,a ,federal national security  
agency or homeland security agency may  
revoke such delay or extend the period  
of time set forth in the original       
request made under this paragraph by a  
subsequent written request if further   
delay is necessary4  7d7 ,method and    
content of notification  7#a7 ,direct   
notification  7,a7 ,method of           
notification ,a person required to      

provide notification to individuals     
under subsection 7a77#a7 shall be in    
compliance with such requirement if the 
person provides conspicuous and clearly 
identified notification by one of the   
following methods 7provided the selected
 method can reasonably be expected to   
reach the intended individual73  7i7    
,written notification4  7ii7            
,notification by email or other         
electronic means1 if--  7,i7 the        
person's primary method of communication
 with the individual is by email or such
 other electronic means2 or  7,,ii7 the 
individual has consented to receive such
 notification and the notification is   
provided in a manner that is consistent 
with the provisions permitting          
electronic transmission of notices under
 section #aja of the ,electronic        
,signatures in ,global and ,national    
,commerce ,act 7#ae ,u4,s4,c4 #gjja74   
7,b7 ,content of notification           
,regardless of the method by which      
notification is provided to an          

individual under subparagraph 7,a71 such
 notification shall include--  7i7 a    
description of the personal information 
that was acquired or accessed by an     
unauthorized person2  7ii7 a telephone  
number that the individual may use1 at  
no cost to such individual1 to contact  
the person to inquire about the breach  
of security or the information the      
person maintained about that individual2
  7iii7 notice that the individual is   
entitled to receive1 at no cost to such 
individual1 consumer credit reports on a
 quarterly basis for a period of #e     
years1 credit monitoring or other       
service that enables consumers to detect
 the misuse of their personal           
information for a period of #aj years1  
and instructions to the individual on   
requesting such reports or service from 
the person1 except when the only        
information which has been the subject  
of the security breach is the           
individual's first name or initial and  
last name1 or address1 or phone number1 

in combination with a credit or debit   
card number1 and any required security  
code2  7iv7 the toll-free contact       
telephone numbers and addresses for the 
major consumer reporting agencies2  7v7 
a toll-free telephone number and        
,internet website address for the       
,commission whereby the individual may  
obtain information regarding identity   
theft2 and  7vi7 a toll-free telephone  
number and ,internet website address for
 the ,bureau whereby the individual may 
obtain information regarding identity   
theft and credit reports4  7#b7         
,substitute notification  7,a7          
,circumstances giving rise to substitute
 notification ,a person required to     
provide notification to individuals     
under subsection 7a77#a7 may provide    
substitute notification in lieu of the  
direct notification required by         
paragraph 7#a7 if the person owns or    
possesses data in electronic form       
containing personal information of fewer
 than #a1jjj individuals and such direct

 notification is not feasible due to--  
7i7 excessive cost to the person        
required to provide such notification   
relative to the resources of such       
person1 as determined in accordance with
 the regulations issued by the          
,commission under paragraph 7#c77;,a72  
or  7ii7 lack of sufficient contact     
information for the individual required 
to be notified4  7,b7 ,form of          
substitute notification ,such substitute
 notification shall include--  7i7 email
 notification to the extent that the    
person has email addresses of           
individuals to whom it is required to   
provide notification under subsection   
7a77#a72  7ii7 a conspicuous notice on  
the ,internet website of the person 7if 
such person maintains such a website72  
and  7iii7 notification in print and to 
broadcast media1 including major media  
in metropolitan and rural areas where   
the individuals whose personal          
information was acquired reside4  7,c7  
,content of substitute notice ,each form

 of substitute notice under this        
paragraph shall include-- 7i7 notice    
that individuals whose personal         
information is included in the breach of
 security are entitled to receive1 at no
 cost to the individuals1 consumer      
credit reports on a quarterly basis for 
a period of #e years1 credit monitoring 
or other service that enables consumers 
to detect the misuse of their personal  
information for a period of #aj years1  
and instructions on requesting such     
reports or service from the person1     
except when the only information which  
has been the subject of the security    
breach is the individual's first name or
 initial and last name1 or address1 or  
phone number1 in combination with a     
credit or debit card number1 and any    
required security code2 and  7ii7 a     
telephone number by which an individual 
can1 at no cost to such individual1     
learn whether that individual's personal
 information is included in the breach  
of security4  7#c7 ,regulations and     

guidance  7,a7 ,regulations ,not later  
than #a year after the date of enactment
 of this ,act1 the ,commission shall1 by
 regulation under section #eec of title 
#e1 ,united ,states ,code1 establish    
criteria for determining circumstances  
under which substitute notification may 
be provided under paragraph 7#b71       
including criteria for determining if   
notification under paragraph 7#a7 is not
 feasible due to excessive costs to the 
person required to provide such         
notification relative to #e the         
resources of such person4 ,such         
regulations may also identify other     
circumstances where substitute          
notification would be appropriate for   
any person1 including circumstances     
under which the cost of providing       
notification exceeds the benefits to    
consumers4  7,b7 ,guidance ,in addition1
 the ,commission shall provide and      
publish general guidance with respect to
 compliance with this subsection4 ,such 
guidance shall include--  7i7 a         

description of written or email         
notification that complies with the     
requirements of paragraph 7#a72 and     
7ii7 guidance on the content of         
substitute notification under paragraph 
7#b71 including the extent of           
notification to print and broadcast     
media that complies with the            
requirements of such paragraph4  7e7    
,other obligations following breach     
7#a7 ,in general ,a person required to  
provide notification under subsection   
7a7 shall1 upon request of an individual
 whose personal information was included
 in the breach of security1 provide or  
arrange for the provision of1 to each   
such individual and at no cost to such  
individual--  7,a7 consumer credit      
reports from at least one of the major  
consumer reporting agencies beginning   
not later than #cj days following the   
individual's request and continuing on a
 quarterly basis for a period of #aj    
years thereafter2 or  7,b7 a credit     
monitoring or other service that enables

 consumers to detect the misuse of their
 personal information1 beginning not    
later than #cj days following the       
individual's request and continuing for 
a period of #aj years4  7#b7 ,limitation
 ,this subsection shall not apply if the
 only personal information which has    
been the subject of the security breach 
is the individual's first name or       
initial and last name1 or address1 or   
phone number1 in combination with a     
credit or debit card number1 and any    
required security code4  7#c7           
,rulemaking ,as part of the             
,commission's rulemaking described in   
subsection 7d77#c71 the ,commission     
shall determine the circumstances under 
which a person required to provide      
notification under subsection 7a77#a7   
shall provide or arrange for the        
provision of free consumer credit       
reports or credit monitoring or other   
service to affected individuals4  7#d7  
,breach of consumer reporting agency ,in
 the event of a breach of security of a 

consumer reporting agency1 that agency  
shall provide any consumer credit report
 required under paragraph 7#a77;,a7 from
 another consumer reporting agency4  7f7
 ,exemption  7#a7 ,general exemption ,a 
person shall be exempt from the         
requirements under this section if1     
following a breach of security1 such    
person determines that there is no      
reasonable risk of identity theft1      
fraud1 or other unlawful conduct4  7#b7 
,presumption  7,a7 ,in general ,if the  
data in electronic form containing      
personal information is rendered        
unusable1 unreadable1 or indecipherable 
through encryption or other security    
technology or methodology 7if the method
 of encryption or such other technology 
or methodology is generally accepted by 
experts in the information security     
field71 there shall be a presumption    
that no reasonable risk of identity     
theft1 fraud1 or other unlawful conduct 
exists following a breach of security of
 such data4 ,any such presumption may be

 rebutted by facts demonstrating that   
the encryption or other security        
technologies or methodologies in a      
specific case1 have been or are         
reasonably likely to be compromised4    
7,b7 ,methodologies or technologies ,not
 later than #a year after the date of   
the enactment of this ,act and          
biannually thereafter1 the ,commission  
shall issue rules 7pursuant to section  
#eec of title #e1 ,united ,states ,code7
 or guidance to identify security       
methodologies or technologies which     
render data in electronic form unusable1
 unreadable1 or indecipherable1 that    
shall1 if applied to such data1         
establish a presumption that no         
reasonable risk of identity theft1      
fraud1 or other unlawful conduct exists 
following a breach of security of such  
data4 ,any such presumption may be      
rebutted by facts demonstrating that any
 such methodology or technology in a    
specific case has been or is reasonably 
likely to be compromised4 ,in issuing   

such rules or guidance1 the ,commission 
shall consult with relevant industries1 
consumer organizations1 and data        
security and identity theft prevention  
experts and established standards       
setting bodies4  7#c7 ,,ftc guidance    
,not later than #a year after the date  
of the enactment of this ,act the       
,commission shall issue guidance        
regarding the application of the        
exemption in paragraph 7#a74  7g7       
,website notice of federal trade        
commission ,if the ,commission1 upon    
receiving notification of any breach of 
security that is reported to the        
,commission under subsection 7a77#b71   
finds that notification of such a breach
 of security via the ,commission's      
,internet website would be in the public
 interest or for the protection of      
consumers1 the ,commission shall place  
such a notice in a clear and conspicuous
 location on its ,internet website4  7h7
 ,website notice of consumer financial  
protection bureau ,if the ,bureau1 upon 

receiving notification of any breach of 
security that is reported to the ,bureau
 under subsection 7a77#b71 finds that   
notification of such a breach of        
security via the ,bureau's ,internet    
website would be in the public interest 
or for the protection of consumers1 the 
,bureau shall place such a notice in a  
clear and conspicuous location on its   
,internet website4  7i7 ,,ftc study on  
notification in languages in addition to
 ,english ,not later than #a year after 
the date of enactment of this ,act1 the 
,commission1 in consultation with the   
,bureau1 shall conduct a study on the   
practicality and cost effectiveness of  
requiring the notification required by  
subsection 7d77#a7 to be provided in a  
language in addition to ,english to     
individuals known to speak only such    
other language4  7j7 ,general rulemaking
 authority ,the ,commission and ,bureau 
may promulgate regulations necessary    
under section #eec of title #e1 ,united 
,states ,code1 to effectively enforce   

the requirements of this section4  7k7  
,treatment of persons governed by other 
law ,a person who is in compliance with 
any other ,federal law that requires    
such person to provide notification to  
individuals following a breach of       
security1 and that1 taken as a whole1   
provides protections substantially      
similar to1 or greater than1 those      
required under this section1 as the     
,commission shall determine by rule     
7under section #eec of title #e1 ,united
 ,states ,code71 shall be deemed to be  
in compliance with this section4  #b4   
,application and enforcement  7a7       
,enforcement by the federal trade       
commission  7#a7 ,unfair or deceptive   
acts or practices ,a violation of       
section #a shall be treated as an unfair
 and deceptive act or practice in       
violation of a regulation under section 
#ah7;a77#a77;,b7 of the ,federal ,trade 
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b77 regarding unfair or  
deceptive acts or practices4  7#b7      

,powers of commission ,the ,commission  
shall enforce this ,act in the same     
manner1 by the same means1 and with the 
same jurisdiction1 powers1 and duties as
 though all applicable terms and        
provisions of the ,federal ,trade       
,commission ,act 7#ae ,u4,s4,c4 #da et  
seq47 were incorporated into and made a 
part of this ,act4 ,any person who      
violates such regulations shall be      
subject to the penalties and entitled to
 the privileges and immunities provided 
in that ,act4  7#c7 ,limitation ,in     
promulgating rules under this ,act1 the 
,commission shall not require the       
deployment or use of any specific       
products or technologies1 including any 
specific computer software or hardware4 
7b7 ,enforcement by state attorneys     
general  7#a7 ,civil action ,in any case
 in which the attorney general of a     
,state1 or an official or agency of a   
,state1 has reason to believe that an   
interest of the residents of that ,state
 has been or is threatened or adversely 

affected by any person who violates     
section #a of this ,act1 the attorney   
general1 official1 or agency of the     
,state1 as parens patriae1 may bring a  
civil action on behalf of the residents 
of the ,state in a district court of the
 ,united ,states of appropriate         
jurisdiction--  7,a7 to enjoin further  
violation of such section by the        
defendant2  7,b7 to compel compliance   
with such section2 or  7,c7 to obtain   
civil penalties in the amount determined
 under paragraph 7#b74  7#b7 ,civil     
penalties  7,a7 ,calculation ,for       
purposes of paragraph 7#a77;,c7 with    
regard to a violation of section #a1 the
 amount determined under this paragraph 
is the amount calculated by multiplying 
the number of violations of such section
 by an amount not greater than #aa1jjj4 
,each failure to send notification as   
required under section #c to a resident 
of the ,state shall be treated as a     
separate violation4  7,b7 ,adjustment   
for inflation ,beginning on the date    

that the ,consumer ,price ,index is     
first published by the ,bureau of ,labor
 ,statistics that is after #a year after
 the date of enactment of this ,act1 and
 each year thereafter1 the amounts      
specified in clause 7i7 of subparagraph 
7,a7 shall be increased by the          
percentage increase in the ,consumer    
,price ,index published on that date    
from the ,consumer ,price ,index        
published the previous year4  7,c7      
,maximum total liability ,not           
withstanding the number of actions which
 may be brought against a person under  
this subsection1 the maximum civil      
penalty for which any person may be     
liable under this subsection shall not  
exceed--  7i7 #e1jjj1jjj for each       
violation of section #b2 and  7ii7      
#e1jjj1jjj for all violations of section
 #c resulting from a single breach of   
security4  7#c7 ,intervention by the    
,,ftc  7,a7 ,notice and intervention    
,the ,state shall provide prior written 
notice of any action under paragraph    

7#a7 to the ,commission and provide the 
,commission with a copy of its          
complaint1 except in any case in which  
such prior notice is not feasible1 in   
which case the ,state shall serve such  
notice immediately upon instituting such
 action4 ,the ,commission shall have the
 right--  7i7 to intervene in the       
action2  7ii7 upon so intervening1 to be
 heard on all matters arising therein2  
and  7iii7 to file petitions for appeal4
  7,b7 ,limitation on state action while
 federal action is pending ,if the      
,commission has instituted a civil      
action for violation of this ,act1 no   
,state attorney general1 or official or 
agency of a ,state1 may bring an action 
under this subsection during the        
pendency of that action against any     
defendant named in the complaint of the 
,commission for any violation of this   
,act alleged in the complaint4  7#d7    
,construction ,for purposes of bringing 
any civil action under paragraph 7#a71  
nothing in this ,act shall be construed 

to prevent an attorney general of a     
,state from exercising the powers       
conferred on the attorney general by the
 laws of that ,state to--  7,a7 conduct 
investigations2  7,b7 administer oaths  
or affirmations2 or  7,c7 compel the    
attendance of witnesses or the          
production of documentary and other     
evidence4  7c7 ,affirmative defense for 
a violation of section #a  7#a7 ,in     
general ,it shall be an affirmative     
defense to an enforcement action brought
 under subsection 7a71 or a civil action
 brought under subsection 7b71 based on 
a violation of section #a1 that all of  
the personal information contained in   
the data in electronic form that was    
acquired or accessed as a result of a   
breach of security of the defendant is  
public record information that is       
lawfully made available to the general  
public from ,federal1 ,state1 or local  
government records and was acquired by  
the defendant from such records4  7#b7  
,no effect on other requirements        

,nothing in this subsection shall be    
construed to exempt any person from the 
requirement to notify the ,commission of
 a breach of security as required under 
section #c7;a74  #c4 ,prohibition on    
certain contract clauses  7a7 ,unlawful 
conduct ,it shall be unlawful for any   
person to include a clause in a contract
 that-- 7#a7 prohibits an individual    
described in section 7#a77;a77#a7 from  
pursuing civil action related to the    
breach2 or  7#b7 requires mandatory     
arbitration related to the breach4  7b7 
,violation of rule ,a violation of      
subsection 7a7 shall be treated as a    
violation of a rule defining an unfair  
or deceptive act or practice prescribed 
under section #ah7;a77#a77;,b7 of the   
,federal ,trade ,commission ,act 7#ae   
,u4,s4,c4 #eg;a7a77#a77;,b774  7c7      
,powers of commission ,the ,commission  
shall enforce this section in the same  
manner1 by the same means1 and with the 
same jurisdiction1 powers1 and duties as
 though all applicable terms and        

provisions of the ,federal ,trade       
,commission ,act 7#ae ,u4,s4,c4 #da et  
seq47 were incorporated into and made a 
part of this ,act4 ,any person who      
violates subsection 7a7 shall be subject
 to the penalties and entitled to the   
privileges and immunities provided in   
the ,federal ,trade ,commission ,act4   
#d4 ,definitions ,in this ,act3 7#a7    
,breach of security ,the term breach of 
security means the unauthorized         
acquisition of data in electronic form  
containing personal information4  7#b7  
,bureau ,the term ,bureau means the     
,consumer ,financial ,protection        
,bureau4  7#c7 ,commission ,the term    
,commission means the ,federal ,trade   
,commission4  7#d7 ,consumer reporting  
agency ,the term consumer reporting     
agency has the meaning given the term   
consumer reporting agency that compiles 
and maintains files on consumers on a   
nationwide basis in section #fjc7p7 of  
the ,fair ,credit ,reporting ,act 7#ae  
,u4,s4,c4 #afha;a7p774  7#e7 ,data in   

electronic form ,the term data in       
electronic form means any data stored   
electronically or digitally on any      
computer system or other database and   
includes recordable tapes and other mass
 storage devices4  7#f7 ,encryption ,the
 term encryption means the protection of
 data in electronic form in storage or  
in transit using an encryption          
technology that has been adopted by an  
established standards setting body which
 renders such data indecipherable in the
 absence of associated cryptographic    
keys necessary to enable decryption of  
such data4 ,such encryption must include
 appropriate management and safeguards  
of such keys to protect the integrity of
 the encryption4  7#g7 ,identity theft  
,the term identity theft means the      
unauthorized use of another person's    
personal information for the purpose of 
engaging in commercial transactions     
under the name of such other person4    
7#h7 ,non-public information ,the term  
non-public information means information

 about an individual that is of a       
private nature and neither available to 
the general public nor obtained from a  
public record4  7#i7 ,personal          
information  7,a7 ,definition ,the term 
personal information means any          
information or compilation of           
information that includes any of the    
following3 7i7 ,an individual's first   
name or initial and last name in        
combination with any or more of the     
following data elements for that        
individuals3  7,i7 ,home address or     
telephone number4  7,,ii7 ,mother's     
maiden name4  7,,iii7 ,month1 day1 and  
year of birth4  7,,iv7 ,user name or    
electronic mail address4  7ii7 ,driver's
 license number1 passport number1       
military identification number1 alien   
registration number1 or other similar   
number issued on a government document  
used to verify identity4  7iii7 ,unique 
account identifier1 including a         
financial account number1 credit or     
debit card number1 electronic           

identification number1 user name1 or    
routing code4  7iv7 ,partial or complete
 ,social ,security number4  7v7 ,unique 
biometric or genetic data such as a     
fingerprint1 voice print1 a retina or   
iris image1 or any other unique physical
 representations4  7vi7 ,information    
that could be used to access an         
individual's account1 such as user name 
and password or email address and       
password4  7vii7 ,any two or more of the
 following data elements3 7,i7 ,an      
individual's first and last name or     
first initial and last name4  7,,ii7 ,a 
unique account identifier1 including a  
financial account number or credit or   
debit card number1 electronic           
identification number1 user name1 or    
routing code4  7,,iii7 ,any security    
code1 access code1 or password1 or      
source code that could be used to       
generate such codes or passwords4       
7viii7 ,information generated or derived
 from the operation or use of an        
electronic communications device that is

 sufficient to identify the street name 
and name of the city or town in which   
the device is located4  7ix7 ,any       
information regarding an individual's   
medical history1 mental or physical     
condition1 medical treatment or         
diagnosis by a health care professional1
 or the provision of health care to the 
individual1 including health information
 provided to a website or mobile        
application4  7x7 ,a health insurance   
policy number or subscriber             
identification number and any unique    
identifier used by a health insurer to  
identify the individual1 or any         
information in an individual's health   
insurance application and claims        
history1 including any appeals records4 
7xi7 ,digitized or other electronic     
signature4  7xii7 ,nonpublic            
communications or other user-created    
content such as emails1 photographs1 or 
videos4  7xiii7 ,any record or          
information concerning payroll1 income1 
financial accounts1 mortgages1 loans1   

lines of credit1 utility bills1         
accumulated purchases1 or any other     
information regarding financial assets1 
obligations1 or spending habits4  7xiv7 
,any additional element the ,commission 
defines as personal information4  7,b7  
,modified definition by rulemaking ,the 
,commission may1 by rule promulgated    
under section #eec of title #e1 ,united 
,states ,code1 modify the definition of 
personal information under subparagraph 
7,a74  7#aj7 ,public record information 
,the term public record information     
means information about an individual   
which has been obtained originally from 
records of a ,federal1 ,state1 or local 
government entity that are available for
 public inspection4  7#aa7 ,service     
provider ,the term service provider     
means an entity that provides to a user 
transmission1 routing1 intermediate and 
transient storage1 or connections to its
 system or network1 for electronic      
communications1 between or among points 
specified by such user of material of   

the user's choosing1 without            
modification to the content of the      
material as sent or received4 ,any such 
entity shall be treated as a service    
provider under this ,act only to the    
extent that it is engaged in the        
provision of such transmission1 routing1
 intermediate and transient storage1 or 
connections4  7#ab7 ,state ,the term    
,state means each of the several        
,states1 the ,district of ,columbia1 the
 ,commonwealth of ,puerto ,rico1 ,guam1 
,american ,samoa1 the ,united ,states   
,virgin ,islands1 the ,commonwealth of  
the ,northern ,mariana ,islands1 any    
other territory or possession of the    
,united ,states1 and each federally     
recognized ,indian ,tribe4  #e4 ,effect 
on other laws  7a7 ,preemption of state 
information security laws ,this ,act    
supersedes any provision of a statute1  
regulation1 or rule of a ,state or      
political subdivision of a ,state1 with 
respect to those entities covered by the
 regulations issued pursuant to this    

,act1 that expressly requires           
notification to individuals of a breach 
of security resulting in unauthorized   
access to or acquisition of data in     
electronic form containing personal     
information4  7b7 ,additional preemption
  7#a7 ,in general ,no person other than
 a person specified in section #b7;b7   
may bring a civil action under the laws 
of any ,state if such action is premised
 in whole or in part upon the defendant 
violating any provision of this ,act4   
7#b7 ,protection of consumer protection 
laws ,this subsection shall not be      
construed to limit the enforcement of   
any ,state consumer protection law by an
 attorney general of a ,state4  7c7     
,protection of certain state laws ,this 
,act shall not be construed to preempt  
the applicability of-- 7#a7 ,state      
trespass1 contract1 or tort law2 or     
7#b7 other ,state laws to the extent    
that those laws relate to acts of fraud4
  7d7 ,preservation of ,,ftc authority  
,nothing in this ,act may be construed  

to limit or affect the ,commission's    
authority under any other provision of  
law4  #f4 ,effective date ,this ,act    
shall take effect #a year after the date
 of enactment of this ,act4  #g4        
,authorization of appropriations ,there 
is authorized to be appropriated to the 
,commission #a1jjj1jjj for each of      
fiscal years #bjah through #bjbc to     
carry out this ,act4