,i #aae? ,,congress #a/ ,session ,h4 ,r4 #cijd ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,octob] #b1 #bjag,mrs4 ,d+ell introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,en]gy & ,comm]ce ,a ,,bill ,to direct ! ,f$]al ,trade ,commission to prescribe rules t require cov]$ entities to secure s5sitive p]sonally id5tifiable in=mation aga9/ a security brea*4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,data ,protection ,act ( #bjag4 #b4 ,reasonable measures to secure s5sitive p]sonally id5tifiable in=mation 7a7 ,rules requir$ ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all prescribe rules 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 t require a cov]$ entity to employ reasonable measures to secure s5sitive p]sonally id5tifiable in=mation ma9ta9$ by su* entity aga9/ a security brea*4 7b7 ,factors = consid]ation 9 det]m9+ reasonabl5ess ,! rules prescrib$ "u subsection 7a7 %all provide = ! consid]ation1 9 det]m9+ :e!r measures employ$ by a cov]$ entity are reasonable1 ( factors t include ! foll[+3 7#a7 ,:e!r ! cov]$ entity foll[s any applicable be/ practices issu$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7#b7 ,:e!r ! cov]$ entity takes reasonable /eps to keep s(tw>e up-to-date 9 ord] to mitigate security vuln]abilities1 especially critical security vuln]abilities1 9 any database or o!r comput] sy/em 9 :i* s5sitive p]sonally id5tifiable in=mation is ma9ta9$ by su* entity4 7c7 ,consid]ation ( b9d+ arbitration clauses 9 det]m9+ civil p5alty am\nt ,if a violation ( ! rules prescrib$ "u subsection 7a7 results 9 a security brea* & ! cov]$ entity exp]i5c+ su* brea* (f]s any cr$it1 id5tity !ft1 fraud1 or simil> monitor+ or protection s]vice to consum]s z a result ( su* brea*1 9 det]m9+ ! am\nt ( a civil p5alty "u section #e7m7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7m77 = su* violation1 ! c\rt %all consid]1 9 addition to ! factors requir$ to be consid]$ "u su* section1 impos+ a high] p5alty if ! t]ms & conditions applicable to su* s]vice include a requirem5t t any disputes be resolv$ by b9d+ arbitration 7or a requirem5t t consum]s take action to opt out ( b9d+ arbitration7 ?an if su* t]ms & conditions did n include any su* requirem5t4 #c4 ,en=cem5t by ,f$]al ,trade ,commission 7a7 ,unfair or deceptive acts or practices ,a violation ( a rule prescrib$ "u section #b7;a7 %all be treat$ z a violation ( a rule prescrib$ "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices4 7b7 ,p[]s ( ,commission ,! ,commission %all en=ce ! rules prescrib$ "u section #b7;a7 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act4 ,any p]son :o violates su* a rule %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act4 #d4 ,def9itions ,9 ?is ,act3 7#a7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#b7 ,cov]$ entity ,! t]m cov]$ entity means any p]son1 p>tn]%ip1 or corporation-- 7,a7 ov] :i* ! ,commission has jurisdiction "u section #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 & 7,b7 t ma9ta9s s5sitive p]sonally id5tifiable in=mation ( m ?an #ajj1jjj individuals4 7#c7 ,security brea* 7,a7 ,9 g5]al ,! t]m security brea* means a compromise ( ! security1 confid5tiality1 or integrity (1 or ! loss (1 comput]iz$ data t results 91 or !re is a reasonable basis to conclude has result$ 9-- 7i7 ! unau?oriz$ acquisition ( s5sitive p]sonally id5tifiable in=mation2 or 7ii7 access to s5sitive p]sonally id5tifiable in=mation t is = an unau?oriz$ purpose1 or 9 excess ( au?orization4 7,b7 ,exclusion ,! t]m security brea* does n include any lawfully au?oriz$ inve/igative1 protective1 or intellig5ce activity ( a law en=cem5t ag5cy ( ! ,unit$ ,/ates1 a ,/ate1 or a political subdivision ( a ,/ate1 or ( an elem5t ( ! intellig5ce community 7z def9$ 9 section #c7d7 ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjjc7d7774 7#d7 ,s5sitive p]sonally id5tifiable in=mation 7,a7 ,9 g5]al ,! t]m s5sitive p]sonally id5tifiable in=mation means any in=mation or compilation ( in=mation1 9 electronic or digital =m1 t includes "o or m ( ! foll[+3 7i7 ,an individual's fir/ & la/ "n or fir/ initial & la/ "n 9 comb9ation ) any two ( ! foll[+ data elem5ts3 7,i7 ,home address or telephone numb]4 7,,ii7 ,"m's maid5 "n4 7,,iii7 ,mon?1 day1 & ye> ( bir?4 7ii7 ,a ,social ,security numb] 7b n includ+ only ! la/ f\r digits ( a ,social ,security numb]71 driv]'s lic5se numb]1 passport numb]1 or ali5 regi/ration numb] or o!r ,gov]nm5t-issu$ unique id5tification numb]4 7iii7 ,unique biometric data su* z a f+] pr9t1 voice pr9t1 a ret9a or iris image1 or any o!r unique physical repres5tation4 7iv7 ,a unique acc\nt id5tifi]1 includ+ a f9ancial acc\nt numb] or cr$it or debit c>d numb]1 electronic id5tification numb]1 us] "n1 or r\t+ code4 7v7 ,a us] "n or electronic mail address1 9 comb9ation ) a password or security "q & answ] t w\ld p]mit access to an onl9e acc\nt4 7vi7 ,any comb9ation ( ! foll[+ data elem5ts3 7,i7 ,an individual's fir/ & la/ "n or fir/ initial & la/ "n4 7,,ii7 ,a unique acc\nt id5tifi]1 includ+ a f9ancial acc\nt numb] or cr$it or debit c>d numb]1 electronic id5tification numb]1 us] "n1 or r\t+ code4 7,,iii7 ,any security code1 access code1 or password1 or s\rce code t c\ld be us$ to g5]ate su* codes or passwords4 7,b7 ,modifi$ def9ition by rulemak+ ,! ,commission may1 by rule prescrib$ 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 am5d ! def9ition ( s5sitive p]sonally id5tifiable in=mation to ! ext5t t su* am5dm5t w accompli% ! purposes ( ?is ,act4 ,9 am5d+ ! def9ition1 ! ,commission may det]m9e-- 7i7 t any p>ticul> comb9ations ( in=mation are s5sitive p]sonally id5tifiable in=mation2 or 7ii7 t any p>ticul> piece ( in=mation1 on its own1 is s5sitive p]sonally id5tifiable in=mation4