,i #aaeth ,,congress #ast ,session ,h4 ,r4 #cige ,,in ,,the ,,house ,,of ,,representatives ,october #e1 #bjag,mr4 ,correa 7for himself1 ,ms4 ,norton1 ,ms4 ,hanabusa1 and ,mr4 ,brendan ,f4 ,boyle of ,pennsylvania7 introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to require covered entities to provide notification in the case of a breach of unsecured sensitive personally identifiable information in electronic or digital form1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,breach ,notification ,act of #bjag4 #b4 ,notification of information security breach 7a7 ,notification required 7#a7 ,by covered entity ,a covered entity that collects1 uses1 accesses1 transmits1 stores1 or disposes of unsecured sensitive personally identifiable information in electronic or digital form shall1 in the case of a breach of such information that is discovered by the covered entity1 notify-- 7,a7 appropriate ,federal agencies2 7,b7 each individual whose unsecured sensitive personally identifiable information has been1 or is reasonably believed by the covered entity to have been1 accessed1 acquired1 or disclosed as a result of such breach2 7,c7 the attorney general of each ,state in which an individual described in subparagraph 7,b7 resides2 and 7,d7 if there are #ejj or more individuals described in subparagraph 7,b7 who reside in a ,state or other jurisdiction1 prominent media outlets serving such ,state or other jurisdiction4 7#b7 ,by third party 7,a7 ,to covered entity ,a third party that collects1 uses1 accesses1 transmits1 stores1 or disposes of unsecured sensitive personally identifiable information in electronic or digital form that is owned or licensed by a covered entity shall1 following the discovery of a breach of such information1 notify the covered entity of such breach4 ,such notification shall include the identification of each individual whose unsecured sensitive personally identifiable information has been1 or is reasonably believed by the third party to have been1 accessed1 acquired1 or disclosed during such breach and the information described in paragraphs 7#a71 7#b71 and 7#d7 of subsection 7d7 with respect to such breach4 ,the covered entity shall make the notifications required by paragraph 7#a7 with respect to such breach4 7,b7 ,to ,,ftc and ,,fbi ,if there are #ejj or more individuals described in subparagraph 7,a7 with respect to a breach1 the third party shall provide the notification required by such subparagraph to the ,commission and the ,federal ,bureau of ,investigation1 as well as to the covered entity4 ,notification by the third party under this subparagraph does not relieve the covered entity of the requirement to notify the ,commission and the ,federal ,bureau of ,investigation under paragraph 7#a77;,a74 7b7 ,timeliness of notification 7#a7 ,in general ,all notifications required under subsection 7a7 shall be made in the most expedient time possible and without unreasonable delay1 but in no case later than #cj calendar days after the discovery of a breach by the covered entity involved 7or by the third party involved in the case of a notification required under subsection 7a77#b77;,a774 7#b7 ,expedited notification to ,,ftc and ,,fbi ,notwithstanding paragraph 7#a71 if there are #ejj or more individuals to which a covered entity is required to provide notification of a breach under subsection 7a77#a77;,b71 the covered entity shall notify the ,commission and the ,federal ,bureau of ,investigation of such breach as required under subsection 7a77#a77;,a7 not later than #dh hours after the discovery of such breach by the covered entity4 7#c7 ,expedited notification by third parties ,notwithstanding paragraph 7#a71 a third party subject to subsection 7a77#b77;,b7 with respect to a breach shall make the notifications required by such subsection not later than #dh hours after discovery of the breach by the third party4 7#d7 ,burden of proof ,the covered entity involved 7or the third party involved in the case of a notification required under subsection 7a77#b77 shall have the burden of demonstrating that all notifications were made as required under subsection 7a71 including evidence demonstrating the necessity of any delay4 7#e7 ,breaches treated as discovered ,for purposes of this section1 a breach shall be treated as discovered by a covered entity or1 in the case of a breach described in subsection 7a77#b71 by a third party1 as of the first day on which such breach is known to such covered entity or third party1 respectively 7including any person1 other than the individual committing the breach1 that is an employee1 officer1 or other agent of such covered entity or third party1 respectively7 or should reasonably have been known to such covered entity or third party 7or person7 to have occurred4 7c7 ,methods of individual notification ,notification required to be provided to an individual under subsection 7a77#a77;,b7 with respect to a breach shall be provided in the following form3 7#a7 ,written notification by first-class mail to the individual 7or the next of kin of the individual if the individual is deceased7 at the last known address of the individual or the next of kin1 respectively1 or1 if specified as a preference by the individual1 by electronic mail4 ,the notification may be provided in one or more mailings as information is available4 7#b7 ,in the case in which there is insufficient or out-of-date contact information 7including a phone number1 email address1 or any other form of appropriate communication7 that precludes direct written or 7if specified by the individual7 electronic notification to the individual1 a substitute form of notification shall be provided1 including1 in the case that there are #ejj or more individuals for which there is insufficient or out-of-date contact information1 a conspicuous posting for a minimum of #cj days on the homepage of the website of the covered entity involved4 ,such a website posting shall include a toll-free telephone number that an individual can call to learn whether or not the individual's unsecured sensitive personally identifiable information is possibly included in the breach4 7#c7 ,in any case considered by the covered entity involved to require urgency because of possible imminent misuse of unsecured sensitive personally identifiable information1 the covered entity1 in addition to notification as required by paragraphs 7#a7 and 7#b71 may provide information to individuals by telephone or other means1 as appropriate4 7d7 ,content of notification ,each notification of a breach under subsection 7a77#a7 shall include1 to the extent possible1 the following3 7#a7 ,a brief description of what happened1 including the date of the breach and the date of the discovery of the breach1 if known4 7#b7 ,a description of the types of unsecured sensitive personally identifiable information that were involved in the breach4 7#c7 ,the steps individuals should take to protect themselves from potential harm resulting from the breach4 7#d7 ,a brief description of what the entity involved is doing to investigate the breach1 to mitigate losses1 and to protect against any further breaches4 7#e7 ,contact procedures for individuals to ask questions or learn additional information1 which shall include a toll-free telephone number1 an e-mail address1 a website1 and a postal address4 7e7 ,posting on ,,ftc public website ,the ,commission shall make available to the public on the website of the ,commission a list that identifies each covered entity that is required to notify #ejj or more individuals of a breach under subsection 7a77#a77;,b71 except to the extent notification with respect to such breach is subject to a delay for law enforcement or national security purposes under subsection 7f74 7f7 ,delay of notification for law enforcement or national security 7#a7 ,in general ,if the ,director of the ,federal ,bureau of ,investigation determines that the notifications required under subparagraphs 7,b71 7,c71 and 7,d7 of subsection 7a77#a7 would impede a criminal investigation or national security activity1 the time period for such notifications shall be extended #cj days upon written notice from the ,director to the covered entity that experienced the breach and to the ,commission4 7#b7 ,extended delay of notification ,if the time period for notification required under subparagraphs 7,b71 7,c71 and 7,d7 of subsection 7a77#a7 is extended pursuant to paragraph 7#a71 a covered entity shall provide the notification within such time period unless the ,director of the ,federal ,bureau of ,investigation provides written notice to the covered entity and to the ,commission that further extension of the time period is necessary4 ,the ,director may extend the time period for additional periods of up to #cj days each4 7#c7 ,immunity ,no cause of action for which jurisdiction is based under section #acdf7;b7 of title #bh1 ,united ,states ,code1 shall lie against any ,federal law enforcement agency for acts relating to the extension of the deadline for notification for law enforcement or national security purposes under this subsection4 #c4 ,enforcement by ,federal ,trade ,commission2 ,regulations 7a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7b7 ,powers of ,commission ,the ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 7c7 ,regulations ,not later than #ahj days after the date of the enactment of this ,act1 the ,commission shall promulgate regulations in accordance with section #eec of title #e1 ,united ,states ,code1 to implement this ,act4 #d4 ,reports to ,congress 7a7 ,in general ,not later than #ab months after the date of the enactment of this ,act and annually thereafter1 the ,commission shall prepare and submit to the ,committee on ,energy and ,commerce of the ,house of ,representatives and the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate a report containing information regarding breaches for which notification was provided to the ,commission under section #b7;a77#a77;,a74 7b7 ,information required ,such information shall include-- 7#a7 the number and nature of such breaches2 7#b7 the number of individuals affected2 and 7#c7 actions taken in response to such breaches4 #e4 ,excluded entities ,nothing in this ,act1 or the regulations promulgated under this ,act1 shall apply to-- 7#a7 covered entities to the extent that such entities act as covered entities or business associates 7as such terms are defined in section #acdjj of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agiba77 that are subject to section #acdjb of such ,act 7#db ,u4,s4,c4 #agicb72 and 7#b7 covered entities to the extent that they act as vendors of personal health records 7as such term is defined in section #acdjj of such ,act 7#db ,u4,s4,c4 #agiba77 and third-party service providers that are subject to section #acdjg of such ,act 7#db ,u4,s4,c4 #agicg74 #f4 ,definitions ,in this ,act3 7#a7 ,appropriate ,federal agency ,the term appropriate ,federal agency means-- 7,a7 the ,commission2 7,b7 the ,federal ,bureau of ,investigation2 and 7,c7 any other ,federal agency specified by the ,commission by regulation1 which may include a specification of different ,federal agencies depending on the types of activities in which covered entities are engaged4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,covered entity ,the term covered entity means any person1 partnership1 or corporation over which the ,commission has jurisdiction under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b774 7#d7 ,sensitive personally identifiable information 7,a7 ,in general ,the term sensitive personally identifiable information means any information1 or compilation of information1 in electronic or digital form that includes one or more of the following3 7i7 ,an individual's first and last name or first initial and last name in combination with any two of the following data elements3 7,i7 ,home address or telephone number4 7,,ii7 ,mother's maiden name4 7,,iii7 ,month1 day1 and year of birth4 7ii7 ,a ,social ,security number 7but not including only the last four digits of a ,social ,security number71 driver's license number1 passport number1 or alien registration number or other ,government-issued unique identification number4 7iii7 ,unique biometric data such as a finger print1 voice print1 a retina or iris image1 or any other unique physical representation4 7iv7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 or routing code4 7v7 ,a user name or electronic mail address1 in combination with a password or security question and answer that would permit access to an online account4 7vi7 ,any combination of the following data elements3 7,i7 ,an individual's first and last name or first initial and last name4 7,,ii7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 or routing code4 7,,iii7 ,any security code1 access code1 or password1 or source code that could be used to generate such codes or passwords4 7,b7 ,modified definition by rulemaking ,the ,commission may1 by rule promulgated under section #eec of title #e1 ,united ,states ,code1 amend the definition of sensitive personally identifiable information to the extent that such amendment will accomplish the purposes of this ,act4 ,in amending the definition1 the ,commission may determine-- 7i7 that any particular combinations of information are sensitive personally identifiable information2 or 7ii7 that any particular piece of information1 on its own1 is sensitive personally identifiable information4 7#e7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 each commonwealth1 territory1 or possession of the ,united ,states1 and each federally recognized ,indian tribe4 7#f7 ,unsecured sensitive personally identifiable information ,the term unsecured sensitive personally identifiable information means sensitive personally identifiable information that is not secured by a technology standard that-- 7,a7 renders information unusable1 unreadable1 or indecipherable to unauthorized individuals2 and 7,b7 is developed or endorsed by a standards developing organization that is accredited by the ,american ,national ,standards ,institute4 #g4 ,relationship to ,state law ,this ,act does not annul1 alter1 or affect1 or exempt any person subject to the provisions of this ,act from complying with1 the laws of any ,state with respect to notification of a breach of personal information in electronic or digital form1 except to the extent that those laws are inconsistent with any provision of this ,act1 and then only to the extent of the inconsistency4 ,for purposes of this section1 a ,state law is not inconsistent with this ,act if the protection such law affords any consumer is greater than the protection provided by this ,act4 #h4 ,effective date ,this ,act shall apply with respect to breaches that are discovered on or after the date that is #cj days after the date on which the ,commission promulgates the regulations required by section #c7;c74