,i #aaeth ,,congress #ast ,session ,h4 ,r4 #chif ,,in ,,the ,,house ,,of ,,representatives ,october #b1 #bjag,ms4 ,schakowsky 7for herself1 ,mr4 ,pallone1 ,mr4 ,butterfield1 ,ms4 ,matsui1 ,mr4 ,tonko1 ,mrs4 ,dingell1 ,mr4 ,welch1 ,mr4 ,mc,nerney1 ,mr4 ,gene ,green of ,texas1 and ,ms4 ,kelly of ,illinois7 introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to require certain entities who collect and maintain personal information of individuals to secure such information and to provide notice to such individuals in the case of a breach of security involving such information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,secure and ,protect ,americans' ,data ,act4 #b4 ,requirements for information security 7a7 ,general security policies1 practices1 and procedures 7#a7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require each covered entity to establish and implement reasonable policies1 practices1 and procedures regarding information security practices for the treatment and protection of personal information taking into consideration-- 7,a7 the size of1 and the nature1 scope1 and complexity of the activities engaged in by such covered entity2 7,b7 the sensitivity of any personal information at issue2 7,c7 the current state of the art in administrative1 technical1 and physical safeguards for protecting such information2 and 7,d7 the cost of implementing such safeguards4 7#b7 ,requirements ,such regulations shall require the policies1 practices1 and procedures to include the following3 7,a7 ,a written security policy with respect to the collection1 use1 sale1 other dissemination1 and maintenance of such personal information4 7,b7 ,the identification of an officer or other individual as the point of contact with responsibility for the management of information security4 7,c7 ,a process for identifying and assessing any reasonably foreseeable vulnerabilities in the system or systems maintained by such covered entity that contains such data1 which shall include regular monitoring for a breach of security of such system or systems4 7,d7 ,a process for taking preventive and corrective action to mitigate against any vulnerabilities identified in the process required by subparagraph 7,c71 which may include implementing any changes to security practices and the architecture1 installation1 or implementation of network or operating software1 and for regularly testing or otherwise monitoring the effectiveness of the safeguards4 7,e7 ,a process for determining if data is no longer needed and disposing of data containing personal information by shredding1 permanently erasing1 or otherwise modifying the personal information contained in such data to make such personal information permanently unreadable or indecipherable4 7,f7 ,a process for overseeing persons who have access to personal information1 including through ,internet-connected devices1 by-- 7i7 taking reasonable steps to select and retain persons that are capable of maintaining appropriate safeguards for the personal information or ,internet-connected devices at issue2 and 7ii7 requiring all such persons to implement and maintain such security measures4 7,g7 ,a process for employee training and supervision for implementation of the policies1 practices1 and procedures required by this subsection4 7,h7 ,a written plan or protocol for internal and public response in the event of a breach of security4 7#c7 ,periodic assessment and consumer privacy and data security modernization ,not less frequently than every #ab months1 each covered entity shall monitor1 evaluate1 and adjust1 as appropriate1 the consumer privacy and data security program of such covered entity in light of any relevant changes in-- 7,a7 technology2 7,b7 internal or external threats and vulnerabilities to personal information2 and 7,c7 the changing business arrangements of the covered entity1 such as-- 7i7 mergers and acquisitions2 7ii7 alliances and joint ventures2 7iii7 outsourcing arrangements2 7iv7 bankruptcy2 and 7v7 changes to personal information systems4 7#d7 ,submission of policies to the ,,ftc ,the regulations promulgated under this subsection shall require each covered entity to submit its security policies to the ,commission in conjunction with a notification of a breach of security under section #c or upon request of the ,commission4 7#e7 ,treatment of entities governed by other federal law ,any covered entity who is in compliance with any other ,federal law that requires such covered entity to maintain standards and safeguards for information security and protection of personal information that1 taken as a whole and as the ,commission shall determine in the rulemaking required under this subsection1 requires covered entities to provide protections substantially similar to1 or greater than1 those required under this subsection1 shall be deemed to be in compliance with this subsection4 7b7 ,special requirements for information brokers 7#a7 ,post-breach audit ,for any information broker required to provide notification under section #c1 the ,commission may require the information broker to conduct independent audits of such practices 7by an independent auditor who has not audited such information broker's security practices during the preceding #e years74 7#b7 ,accuracy of and individual access to personal information 7,a7 ,accuracy 7i7 ,in general ,each information broker shall establish reasonable procedures to assure the maximum possible accuracy of the personal information the information broker collects1 assembles1 or maintains1 and any other information the information broker collects1 assembles1 or maintains that specifically identifies an individual1 other than information which merely identifies an individual's name or address4 7ii7 ,limited exception for fraud databases ,the requirement in clause 7i7 shall not prevent the collection or maintenance of information that may be inaccurate with respect to a particular individual when that information is being collected or maintained solely-- 7,i7 for the purpose of indicating whether there may be a discrepancy or irregularity in the personal information that is associated with an individual2 and 7,,ii7 to help identify1 or authenticate the identity of1 an individual1 or to protect against or investigate fraud or other unlawful conduct4 7,b7 ,consumer access to information ,each information broker shall-- 7i7 provide to each individual whose personal information the information broker maintains1 at the individual's request at least once per year and at no cost to the individual1 and after verifying the identity of such individual1 a means for the individual to review any personal information regarding such individual maintained by the information broker and any other information maintained by the information broker that specifically identifies such individual1 other than information which merely identifies an individual's name or address2 and 7ii7 place a conspicuous notice on the ,internet website of the information broker 7if the information broker maintains such a website7 notifying consumers that the entity is an information broker using specific language that the ,commission shall determine in the rulemaking required under this subsection and instructing individuals how to request access to the information required to be provided under clause 7i71 and1 as applicable1 how to express a preference with respect to the use of personal information for marketing purposes under subparagraph 7,d74 7,c7 ,disputed information ,whenever an individual whose information the information broker maintains makes a written request disputing the accuracy of any such information1 the information broker1 after verifying the identity of the individual making such request and unless there are reasonable grounds to believe such request is frivolous or irrelevant1 shall-- 7i7 correct any inaccuracy2 or 7ii7 in the case of information that is-- 7,i7 public record information1 inform the individual of the source of the information1 and1 if reasonably available1 where a request for correction may be directed and1 if the individual provides proof that the public record has been corrected or that the information broker was reporting the information incorrectly1 correct the inaccuracy in the information broker's records2 or 7,,ii7 nonpublic information1 note the information that is disputed1 including the individual's statement disputing such information1 and take reasonable steps to independently verify such information under the procedures outlined in subparagraph 7,a7 if such information can be independently verified4 7,d7 ,alternative procedure for certain marketing information ,in accordance with regulations issued under subparagraph 7,f71 an information broker that maintains any information described in subparagraph 7,a7 which is used1 shared1 or sold by such information broker for marketing purposes1 may1 in lieu of complying with the access and dispute requirements set forth in subparagraphs 7,b7 and 7,c71 provide each individual whose information the information broker maintains with a reasonable means of expressing a preference not to have his or her information used for such purposes4 ,if the individual expresses such a preference1 the information broker may not use1 share1 or sell the individual's information for marketing purposes4 7,e7 ,limitations ,an information broker may limit the access to information required under subparagraph 7,b77i71 is not required to provide notice to individuals as required under subparagraph 7,b77ii71 and is not required to comply with a disputed information request under subparagraph 7,c7 in the following circumstances3 7i7 ,if access of the individual to the information is limited by law or legally recognized privilege4 7ii7 ,if the information is used for a legitimate governmental or fraud prevention purpose that would be compromised by such access4 7iii7 ,if the information consists of a published media record1 unless that record has been included in a report about an individual shared with a third party4 7,f7 ,rulemaking ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to carry out this paragraph and to facilitate the purposes of this ,act4 ,in addition1 the ,commission shall issue regulations1 as necessary1 under section #eec of title #e1 ,united ,states ,code1 on the scope of the application of the limitations in subparagraph 7,e71 including any additional circumstances in which an information broker may limit access to information under such subparagraph that the ,commission determines to be appropriate4 7,g7 ,,fcra regulated persons ,any information broker who is engaged in activities subject to the ,fair ,credit ,reporting ,act and who is in compliance with sections #fji1 #faj1 and #faa of such ,act 7#ae ,u4,s4,c4 #afha;g2 #afha;h2 #afha;i7 with respect to information subject to such ,act1 shall be deemed to be in compliance with this paragraph with respect to such information4 7#c7 ,requirement of audit log of accessed and transmitted information ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to require information brokers to establish measures which facilitate the auditing or retracing of any internal or external access to1 or transmissions of1 any data containing personal information collected1 assembled1 or maintained by such information broker4 7#d7 ,prohibition on pretexting by information brokers 7,a7 ,prohibition on obtaining personal information by false pretenses ,it shall be unlawful for an information broker to obtain or attempt to obtain1 or cause to be disclosed or attempt to cause to be disclosed to any person1 personal information or any other information relating to any person by-- 7i7 making a false1 fictitious1 or fraudulent statement or representation to any person2 or 7ii7 providing any document or other information to any person that the information broker knows or should know to be forged1 counterfeit1 lost1 stolen1 or fraudulently obtained1 or to contain a false1 fictitious1 or fraudulent statement or representation4 7,b7 ,prohibition on solicitation to obtain personal information under false pretenses ,it shall be unlawful for an information broker to request a person to obtain personal information or any other information relating to any other person1 if the information broker knew or should have known that the person to whom such a request is made will obtain or attempt to obtain such information in the manner described in subparagraph 7,a74 #c4 ,notification of information security breach 7a7 ,individual notification 7#a7 ,in general ,each covered entity shall1 following the discovery of a breach of security1 notify each individual who is a citizen or resident of the ,united ,states whose personal information was1 or is reasonably believed to have been1 acquired or accessed by an unauthorized person1 or used for an unauthorized purpose4 7#b7 ,timeliness of notification 7,a7 ,in general ,unless subject to a delay authorized under subparagraph 7,b71 a notification required under paragraph 7#a7 shall be made as expeditiously as practicable and without unreasonable delay1 but not later than #cj days following the discovery of a breach of security4 7,b7 ,delay of notification authorized for law enforcement or national security purposes 7i7 ,law enforcement ,if a ,federal or ,state law enforcement agency1 including an attorney general of a ,state1 determines that the notification required under this section would impede a civil or criminal investigation1 such notification shall be delayed upon the written request of the law enforcement agency for #cj days or such lesser period of time which the law enforcement agency determines is reasonably necessary and requests in writing4 ,such a law enforcement agency may1 by a subsequent written request1 revoke such delay or extend the period of time set forth in the original request made under this clause if further delay is necessary4 7ii7 ,national security ,if a ,federal national security agency or homeland security agency determines that the notification required under this section would threaten national or homeland security1 such notification may be delayed for a period of time of up to #fj days which the national security agency or homeland security agency determines is reasonably necessary and requests in writing4 ,a ,federal national security agency or homeland security agency may revoke such delay or extend the period of time set forth in the original request made under this clause by a subsequent written request if further delay is necessary4 7iii7 ,limitation on delay or extension ,any delay or extension of notification permitted under this subparagraph may not exceed a total time period of one year4 7b7 ,coordination of notification with consumer reporting agencies ,if a covered entity is required to provide notification to more than #e1jjj individuals under subsection 7a77#a71 the covered entity shall also notify the major consumer reporting agencies that compile and maintain files on consumers on a nationwide basis1 of the timing and distribution of the notifications1 except for a case in which the only information that is the subject of the breach of security is the individual's first name or initial and last name1 address1 or phone number1 in combination with a credit or debit card number and any required security code4 ,such notification shall be given to the consumer reporting agencies without unreasonable delay and1 if such notification will not delay notification to the affected individuals1 prior to the distribution of notifications to the affected individuals4 7c7 ,method and content of notification 7#a7 ,general notification ,a covered entity required to provide notification to individuals under subsection 7a77#a7 shall be in compliance with such requirement if the covered entity provides conspicuous and clearly identified notification by one of the following methods 7provided the selected method can reasonably be expected to reach the intended individual73 7,a7 ,written notification to the last known home mailing address of the individual in the records of the covered entity4 7,b7 ,notification by email or other electronic means1 if-- 7i7 the covered entity's primary method of communication with the individual is by email or such other electronic means2 or 7ii7 the individual has consented to receive such notification and the notification is provided in a manner that is consistent with the provisions permitting electronic transmission of notifications under section #aja of the ,electronic ,signatures in ,global and ,national ,commerce ,act 7#ae ,u4,s4,c4 #gjja74 7#b7 ,website notification ,the covered entity shall also provide conspicuous notification on the ,internet website of the covered entity 7if such covered entity maintains such a website7 for a period of not less than #ij days4 7#c7 ,media notification ,if the number of residents of a ,state whose personal information was1 or is reasonably believed to have been1 acquired or accessed by an unauthorized person1 or used for an unauthorized purpose1 exceeds #e1jjj1 the covered entity shall also provide notification in print and to broadcast media1 including major media in metropolitan and rural areas where the individuals whose personal information was1 or is reasonably believed to have been1 acquired or accessed by an unauthorized person1 or used for an unauthorized purpose1 reside4 7#d7 ,content of notification 7,a7 ,in general ,regardless of the method by which notification is provided to an individual under paragraphs 7#a71 7#b71 and 7#c71 such notification shall include-- 7i7 a description of the personal information that was1 or is reasonably believed to have been1 acquired or accessed by an unauthorized person1 or used for an unauthorized purpose2 7ii7 a general description of the incident and the date or estimated date of the breach of security and the date range during which the personal information was compromised2 7iii7 the acts the covered entity1 or the agent of the covered entity1 has taken to protect personal information from further breach of security2 7iv7 a telephone number1 website1 and email address that the individual may use1 at no cost to such individual1 to contact the covered entity1 or agent of the covered entity1 to inquire about the breach of security or the information the covered entity maintained about that individual2 7v7 in the case of an individual that is entitled to receive services under subsection 7e71 notification that the individual is entitled to receive such services2 7vi7 the toll-free contact telephone numbers and addresses for the major consumer reporting agencies2 and 7vii7 a toll-free telephone number and ,internet website address for the ,commission whereby the individual may obtain information regarding identity theft4 7,b7 ,direct business relationship ,the notification required under subsection 7a7 shall identify the covered entity that has a direct business relationship with the individual1 if applicable1 as well as the entity that experienced the breach of security4 7#e7 ,regulations for substitute notification ,not later than #a year after the date of enactment of this ,act1 the ,commission shall1 by regulation under section #eec of title #e1 ,united ,states ,code-- 7,a7 establish criteria for determining circumstances under which substitute notification may be provided in lieu of direct notification required by paragraph 7#a71 including criteria for determining if notification under paragraph 7#a7 is not feasible due to excessive costs to the covered entity required to provide such notification relative to the resources of such covered entity2 and 7,b7 establish the form and content of substitute notification4 7d7 ,notification for law enforcement and other purposes ,a covered entity shall1 as expeditiously as practicable and without unreasonable delay1 but not later than #e days following the discovery of a breach of security1 provide notification of the breach to-- 7#a7 the ,commission2 7#b7 the ,federal ,bureau of ,investigation2 7#c7 the ,secret ,service2 7#d7 for common carriers1 the ,federal ,communications ,commission2 7#e7 for entities that provide a consumer financial product or service 7as defined in section #ajjb of the ,consumer ,financial ,protection ,act of #bjaj 7#ab ,u4,s4,c4 #edha771 the ,bureau of ,consumer ,financial ,protection2 and 7#f7 the attorney general of each ,state in which the personal information of a resident or residents of the ,state was1 or is reasonably believed to have been1 acquired or accessed by an unauthorized person1 or used for an unauthorized purpose4 7e7 ,other obligations following breach 7#a7 ,in general ,a covered entity required to provide notification under subsection 7a7 shall1 upon request of an individual whose personal information was included in the breach of security1 provide or arrange for the provision of1 to each such individual and at no cost to such individual-- 7,a7 at the option of such individual1 either-- 7i7 consumer credit reports from all of the major consumer reporting agencies beginning not later than #fj days following the individual's request and continuing on a quarterly basis for a period of not less than #aj years thereafter2 or 7ii7 a credit monitoring or other service that-- 7,i7 enables consumers to detect the misuse of their personal information1 beginning not later than #fj days following the individual's request and continuing for a period of not less than #aj years thereafter2 and 7,,ii7 includes monitoring of the individual's credit file at all of the major consumer reporting agencies2 and 7,b7 a service that enables consumers to control access to their personal information and credit reports1 beginning not later than #fj days following the individual's request and continuing for a period of not less than #aj years thereafter4 7#b7 ,limitation ,this subsection shall not apply if the only personal information which has been the subject of the breach of security is the individual's first name or initial and last name1 address1 or phone number1 in combination with a credit or debit card number and any required security code4 7f7 ,exemption 7#a7 ,general exemption ,a covered entity shall be exempt from the requirements under this section if the data containing personal information that was1 or is reasonably believed to have been1 acquired or accessed by an unauthorized person1 or used for an unauthorized purpose1 is unusable1 unreadable1 or indecipherable because of security technologies or methodologies generally accepted by experts in the field of information security at the time the breach of security occurred4 ,this exemption does not apply with regard to the use of encryption technology generally accepted by experts in the field of information security at the time the breach of security occurred if any cryptographic keys necessary to enable decryption of such data are also accessed or acquired without authorization4 7#b7 ,,ftc guidance ,not later than #a year after the date of enactment of this ,act1 the ,commission shall issue guidance regarding the application of the exemption in paragraph 7#a74 7g7 ,website notification of federal trade commission ,if the ,commission1 upon receiving notification of any breach of security that is reported to the ,commission under subsection 7d77#a71 finds that notification of such a breach of security via the ,commission's ,internet website would be in the public interest1 the ,commission shall place such a notification in a clear and conspicuous location on its ,internet website4 7h7 ,website notification of state attorneys general ,if a ,state attorney general1 upon receiving notification of any breach of security that is reported to such ,state attorney general under subsection 7d77#f71 finds that notification of such breach of security via the ,state attorney general's ,internet website would be in the public interest or for the protection of consumers1 the ,state attorney general may place such a notification in a clear and conspicuous location on its ,internet website4 7i7 ,,ftc study on notification in languages in addition to ,english ,not later than #a year after the date of enactment of this ,act1 the ,commission shall conduct a study on the practicality and cost effectiveness of requiring the notification required by subsection 7c77#a7 to be provided in a language in addition to ,english to individuals known to speak only such other language4 7j7 ,education and outreach for small businesses ,the ,commission shall conduct education and outreach for small business concerns on data security practices and how to prevent hacking and other unauthorized access to1 acquisition of1 or use of data maintained by such small business concerns4 7k7 ,website on data security best practices ,the ,commission shall maintain an ,internet website containing nonbinding best practices for businesses regarding data security and how to prevent hacking and other unauthorized access to1 acquisition of1 or use of data maintained by such businesses4 7l7 ,general rulemaking authority 7#a7 ,in general ,the ,commission may promulgate regulations necessary under section #eec of title #e1 ,united ,states ,code1 to effectively enforce the requirements of this section4 7#b7 ,limitation ,in promulgating rules under this ,act1 the ,commission shall not require the deployment or use of any specific products or technologies1 including any specific computer software or hardware4 7m7 ,treatment of persons governed by other law ,a covered entity who is in compliance with any other ,federal law that requires such covered entity to provide notification to individuals following a breach of security in at least the same or substantially similar circumstances and in at the least same or substantially similar manner as required to be provided under this ,act1 taken as a whole and as determined by the ,commission in the rulemaking required under this section1 shall be deemed to be in compliance with this section with respect to activities and information covered under such ,federal law4 #d4 ,application and enforcement 7a7 ,enforcement by the ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #b or #c shall be treated as an unfair and deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices and shall be subject to enforcement by the ,commission under that ,act with respect to any covered entity4 ,all of the functions and powers of the ,commission under the ,federal ,trade ,commission ,act are available to the ,commission to enforce compliance by any person with the requirements imposed under this ,act1 irrespective of whether that person is engaged in commerce or meets any other jurisdictional tests under the ,federal ,trade ,commission ,act4 7#b7 ,coordination with ,federal ,communications ,commission ,where enforcement relates to entities subject to the authority of the ,federal ,communications ,commission1 enforcement actions by the ,commission will be coordinated with the ,federal ,communications ,commission4 7#c7 ,coordination with ,bureau of ,consumer ,financial ,protection ,where enforcement relates to entities that provide a consumer financial product or service 7as defined in section #ajjb of the ,consumer ,financial ,protection ,act of #bjaj 7#ab ,u4,s4,c4 #edha771 enforcement actions by the ,commission will be coordinated with the ,bureau of ,consumer ,financial ,protection4 7b7 ,enforcement by ,state attorneys general 7#a7 ,in general ,if the chief law enforcement officer of a ,state1 or an official or agency designated by a ,state1 has reason to believe that any covered entity has violated or is violating section #b or #c of this ,act1 the attorney general1 official1 or agency of the ,state1 in addition to any authority it may have to bring an action in ,state court under its consumer protection law1 may bring a civil action in any appropriate ,united ,states district court or in any other court of competent jurisdiction1 including a ,state court1 to-- 7,a7 enjoin further such violation by the defendant2 7,b7 enforce compliance with such section2 7,c7 obtain civil penalties2 and 7,d7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state4 7#b7 ,notice and intervention by the ,,ftc ,the attorney general of a ,state shall provide prior written notice of any action under paragraph 7#a7 to the ,commission and provide the ,commission with a copy of the complaint in the action1 except in any case in which such prior notice is not feasible1 in which case the attorney general shall serve such notice immediately upon instituting such action4 ,the ,commission shall have the right-- 7,a7 to intervene in the action2 7,b7 upon so intervening1 to be heard on all matters arising therein2 and 7,c7 to file petitions for appeal4 7#c7 ,limitation on ,state action while ,federal action is pending ,if the ,commission has instituted a civil action for violation of this ,act1 no ,state attorney general1 or official or agency of a ,state1 may bring an action under this subsection during the pendency of that action against any defendant named in the complaint of the ,commission for any violation of this ,act alleged in the complaint4 7#d7 ,relationship with ,state-law claims ,if the attorney general of a ,state has authority to bring an action under ,state law directed at acts or practices that also violate this ,act1 the attorney general may assert the ,state-law claim and a claim under this ,act in the same civil action4 #e4 ,definitions ,in this ,act3 7#a7 ,breach of security ,the term breach of security means unauthorized access to1 acquisition of1 or use of data containing personal information4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,consumer reporting agency ,the term consumer reporting agency has the meaning given that term in section #fjc of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a74 7#d7 ,covered entity ,the term covered entity means-- 7,a7 any organization1 corporation1 trust1 partnership1 sole proprietorship1 unincorporated association1 or venture over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 7,b7 notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq472 and 7,c7 notwithstanding sections #d and #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd and #de7;a77#b771 any nonprofit organization1 including any organization described in section #eja7;c7 of the ,internal ,revenue ,code of #aihf that is exempt from taxation under section #eja7;a7 of the ,internal ,revenue ,code of #aihf4 7#e7 ,information broker ,the term information broker-- 7,a7 means a commercial entity whose business is to collect1 assemble1 or maintain personal information concerning individuals who are not current or former customers of such entity in order to sell such information or provide access to such information to any nonaffiliated third party in exchange for consideration1 whether such collection1 assembly1 or maintenance of personal information is performed by the information broker directly1 or by contract or subcontract with any other entity2 and 7,b7 does not include a commercial entity to the extent that such entity processes information collected by and received from a nonaffiliated third party concerning individuals who are current or former customers or employees of the third party to enable the third party to provide benefits for the employees or directly transact business with the customers4 7#f7 ,personal information 7,a7 ,definition ,the term personal information means any information or compilation of information that includes any of the following3 7i7 ,an individual's first name or initial and last name in combination with any #b or more of the following data elements for that individual3 7,i7 ,home address or telephone number4 7,,ii7 ,mother's maiden name4 7,,iii7 ,month1 day1 and year of birth4 7,,iv7 ,user name or electronic mail address4 7ii7 ,driver's license number1 passport number1 military identification number1 alien registration number1 or other similar number issued on a government document used to verify identity4 7iii7 ,unique account identifier1 including a financial account number1 or credit or debit card number1 electronic identification number1 user name1 or routing code4 7iv7 ,partial or complete ,social ,security number4 7v7 ,unique biometric or genetic data such as a faceprint1 fingerprint1 voice print1 a retina or iris image1 or any other unique physical representations4 7vi7 ,information that could be used to access an individual's account1 such as user name and password or email address and password4 7vii7 ,any security code1 access code1 or password1 or source code that could be used to generate such codes or passwords1 in combination with either of the following data elements3 7,i7 ,an individual's first and last name or first initial and last name4 7,,ii7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 or routing code4 7viii7 ,information generated or derived from the operation or use of an electronic communications device that is sufficient to identify the street name and name of the city or town in which the device is located4 7ix7 ,any information regarding an individual's medical history1 mental or physical condition1 medical treatment or diagnosis by a health care professional1 or the provision of health care to the individual1 including health information provided to a website or mobile application4 7x7 ,a health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual1 or any information in an individual's health insurance application and claims history1 including any appeals records4 7xi7 ,digitized or other electronic signature4 7xii7 ,nonpublic communications or other user-created content such as emails1 photographs1 or videos4 7xiii7 ,any record or information concerning payroll1 income1 financial accounts1 mortgages1 loans1 lines of credit1 utility bills1 accumulated purchases1 or any other information regarding financial assets1 obligations1 or spending habits4 7xiv7 ,any additional element the ,commission defines as personal information4 7,b7 ,modified definition by rulemaking ,the ,commission may1 by rule promulgated under section #eec of title #e1 ,united ,states ,code1 modify the definition of personal information under subparagraph 7,a74 7#g7 ,state ,the term ,state means each of the several ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 ,guam1 ,american ,samoa1 the ,united ,states ,virgin ,islands1 the ,commonwealth of the ,northern ,mariana ,islands1 any other territory or possession of the ,united ,states1 and each federally recognized ,indian tribe4 #f4 ,effect on other laws 7a7 ,preemption of ,state data security and breach notification laws ,no ,state or political subdivision thereof shall have any authority to establish or continue in effect any standard or requirement that is not identical to the standards and requirements established under this ,act for-- 7#a7 information security practices for the treatment and protection of the personal information defined in section #e7f77;,a71 or as subsequently amended by the ,commission under section #e7f77;,b71 by covered entities1 as defined in section #e7d72 or 7#b7 notification to individuals of a breach of security of the personal information defined in section #e7f77;,a71 or as subsequently amended by the ,commission under section #e7f77;,b71 by covered entities1 as defined in section #e7d74 7b7 ,effect on ,state law ,in the case of a provision of the law of a ,state that is superseded by subsection 7a71 this ,act may be enforced in the same manner and to the same extent as the ,state law could have been enforced under ,state law had the provision of the law of the ,state not been superseded4 7c7 ,effect on other ,state laws ,except as provided in subsection 7a71 nothing in this ,act shall be construed to-- 7#a7 preempt or limit any provision of any law1 rule1 regulation1 requirement1 standard1 or other provision having the force and effect of law of any ,state1 including any ,state consumer protection law1 any ,state law relating to acts of fraud or deception1 and any ,state trespass1 contract1 or tort law2 7#b7 preempt or limit any provision of any law1 rule1 regulation1 requirement1 standard1 or other provision having the force and effect of law of any ,state regarding post-data breach services1 including security or credit freezes1 credit monitoring1 identity theft monitoring1 and identity theft services2 7#c7 prevent or limit the attorney general of a ,state from exercising the powers conferred upon the attorney general by the laws of the ,state1 including conducting investigations1 administering oaths or affirmations1 or compelling the attendance of witnesses or the production of documentary and other evidence2 or 7#d7 preempt or limit any provision of any law1 rule1 regulation1 requirement1 standard1 or other provision having the force and effect of law of any ,state with respect to any person that is not a covered entity1 as defined in section #e7d71 or any information that is not personal information1 as defined in section #e7f77;,a71 or as subsequently amended by the ,commission under section #e7f77;,b74 7d7 ,preservation of authority 7#a7 ,federal ,trade ,commission ,nothing in this ,act may be construed in any way to limit the ,commission's authority under any other provision of law4 7#b7 ,federal ,communications ,commission ,nothing in this ,act may be construed in any way to limit or affect the ,federal ,communications ,commission's authority under any other provision of law4 7#c7 ,bureau of ,consumer ,financial ,protection ,nothing in this ,act may be construed in any way to limit or affect the authority of the ,bureau of ,consumer ,financial ,protection under any other provision of law4 #g4 ,effective date ,this ,act shall take effect #ij days after the date of enactment of this ,act4